-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized reflection of user-controlled query parameters in badge generation endpoints. The advisory explicitly states attackers could inject arbitrary HTML/JS via plugin responses. The primary entry point for badge generation would be the action handler method doBadge that processes these parameters. Jenkins plugins typically use *Action classes with do[Verb] methods for HTTP endpoints, and the lack of output encoding here matches the described XSS vulnerability pattern.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:embeddable-build-status-plugin | maven | < 2.0.2 | 2.0.2 |