description: Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control report contents.
affected:
{
product: Jenkins Continuous Integration with Toad Edge Plugin
vendor: Jenkins project
versions:
lessThanOrEqual: 2.3, status: affected, version: unspecified, versionType: custom
}