description: Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
affected:
{
defaultStatus: unknown
product: Jenkins Mashup Portlets Plugin
vendor: Jenkins Project
versions:
lessThanOrEqual: 1.1.2, status: affected, version: 0, versionType: maven
}