Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system with content not controllable by the attackers. Matrix Project Plugin 822.824.v14451bc0fd42 sanitizes user-defined axis names of Multi-configuration project.
Recommended action: Upgrade to 822.824.v14451b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission. Matrix Project Plugin 1.17 escapes the axis names shown in these tooltips.
Recommended action: Upgrade to 1.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Matrix Project Plugin 1.16 and earlier does not escape node names shown in tooltips on the overview page of builds with a single axis. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Agent/Configure permission. Matrix Project Plugin 1.17 escapes the node names shown in these tooltips.
Recommended action: Upgrade to 1.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
Recommended action: Upgrade to 1.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Matrix Project Plugin prior to 1.20 and 1.18.1 does not escape HTML metacharacters in node and label names, and label descriptions. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. Matrix Project Plugin 1.20 and 1.18.1 escapes HTML metacharacters in node and label names, and label descriptions.
Recommended action: Upgrade to 1.20 or 1.18.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.