description: Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from the useMango service.
affected:
{
product: Jenkins useMango Runner Plugin
vendor: Jenkins project
versions:
lessThanOrEqual: 1.4, status: affected, version: unspecified, versionType: custom
}