Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
References:GSA_kwCzR0hTQS0yYzg0LTM1cnYtNnEzZs4AAl8j
Stored XSS vulnerability in ClearCase Release Plugin
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:org.jvnet.hudson.plugins:clearcase-release | <= 0.3 | No known fixed version | |
Affected Version RangesAll affected versions |
|||