5.4
Medium
CVE-2022-46687 Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view,…
Description
Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to change build display names.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Spring Config Plugin 2.0 | earliest → 2.0.0 | No fix stated |