GitHub Advisoryadvisory · Maven

GHSA-mr4j-7jjv-24m7 Jenkins Extra Columns Plugin allows Cross-Site Scripting (XSS)

MEDIUM Published 2022-05-13 Modified 2025-03-13 Official page ↗
Aliases
CVE-2016-3101
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:extra-columns
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.plugins:extra-columns: < 1.17 → fixed in 1.17

Description

Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter.

Related

Alias · CVE (1)

  • CVE-2016-3101 Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References