description: In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.
affected:
{
defaultStatus: affected
product: Jenkins
vendor: Jenkins Project
versions:
lessThan: *, status: unaffected, version: 2.400, versionType: maven
}