Jenkins is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.
Jenkins 2.93 and prior versions are vulnerable.
Information
Jenkins-Ci Jenkins 2.92
Jenkins-Ci Jenkins 2.90
Jenkins-Ci Jenkins 2.89
Jenkins-Ci Jenkins 2.88
Jenkins-Ci Jenkins 2.57
Jenkins-Ci Jenkins 2.56
Jenkins-Ci Jenkins 2.44
Jenkins-Ci Jenkins 2.43
Jenkins-Ci Jenkins 2.32
Jenkins-Ci Jenkins 2.31
Jenkins-Ci Jenkins 2.3
Jenkins-Ci Jenkins 2.2
Jenkins-Ci Jenkins 2.1
Jenkins-Ci Jenkins 2.0
Exploit
An attacker can exploit these issues using a web browser.