CVE-2019-1003050

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.171 Jenkins LTS versions prior to 2.164.1

Description: The issue is related to a cross-site scripting (XSS) vulnerability. It occurs because the f:validateButton form control in the Jenkins UI does not properly escape job URLs. This can be exploited by users who have the ability to control job names.

Recommendations: For Jenkins versions prior to 2.171, update to version 2.171 or later to resolve the issue. For Jenkins LTS versions prior to 2.164.1, update to version 2.164.1 or later to resolve the issue.