Threats tagged 'ghsa-w22p-4x9f-486v'

A stored cross-site scripting (XSS) vulnerability exists in Jenkins GitHub Plugin versions 1.46.0 and earlier. The vulnerability arises from improper processing of the current job URL in JavaScript validation for the "GitHub hook trigger for GITScm polling" feature. This flaw allows non-anonymous users with Overall/Read permission to exploit the vulnerability. The issue is resolved starting from version 1.46.0.1, which no longer processes the current job URL in the vulnerable JavaScript code.