description: Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
affected:
{
product: Jenkins DotCi Plugin
vendor: Jenkins project
versions:
lessThanOrEqual: 2.40.00, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: unknown, version: next of 2.40.00, versionType: custom
}