-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows the vulnerability was fixed by adding Util.escape() to ex.getMessage() in the errorWithMarkup call. The unescaped exception message (which includes user-controlled input from the URL Patterns field) was directly injected into HTML output, creating an XSS vector. The function responsible for validation (doRegexCheck) handled this input without proper sanitization in vulnerable versions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:audit-trail | maven | <= 3.2 | 3.3 |