8.0
Élevée
CVE-2026-84665 Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates…
Description
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jenkins SonarQube Scanner Plugin 2.18 | premières → 2.18.3 | Pas de correctif indiqué |