-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped user-controlled input in search suggestions. The GitHub commit 307ed31 explicitly adds escaping by setting 'ac.formatResult = ac.formatEscapedResult' in the AutoComplete configuration. This indicates the original formatResult implementation lacked proper output encoding. The file hudson-behavior.js contains the client-side search suggestion implementation, and the YUI AutoComplete widget's default result formatting would render raw HTML without escaping prior to this fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | < 2.32.2 | 2.32.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.34, < 2.44 | 2.44 |