description: Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.
affected:
{
defaultStatus: affected
product: Jenkins
vendor: Jenkins Project
versions:
lessThan: *, status: unaffected, version: 2.416, versionType: maven
lessThan: 2.401.*, status: unaffected, version: 2.401.3, versionType: maven
lessThan: 2.414.*, status: unaffected, version: 2.414.1, versionType: maven
}