-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped job names in the UI. Jenkins typically uses Jelly templates for rendering, and XSS vulnerabilities in this context commonly occur when dynamic content is rendered without the h.escape() utility. The advisory explicitly states the lack of escaping for job names used as building blocks, which would be displayed in the Template Workflow configuration interface. While the exact file path is inferred from standard plugin structure patterns, the mechanism (missing output escaping in view templates) aligns with Jenkins' known vulnerability patterns for XSS.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins.plugin.templateWorkflows:template-workflows | maven | <= 41.v32d86a |
Ongoing coverage of React2Shell