Skip to content
Sign in
8.0 High

CVE-2025-5806 Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy…

Description

Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.

Affected products and versions

Product Affected versions Fixed in
Jenkins Gatling Plugin Versions not published

Other CVEs of Jenkins Gatling Plugin

The 2 CVEs of Jenkins Gatling Plugin →
CVE-2020-2173 Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports… Not rated
Track this CVE