description: Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.
affected:
{
vendor: Jenkins Project
product: Jenkins HTML Publisher Plugin
versions:
version: 1.16, versionType: maven, lessThanOrEqual: 1.32, status: affected
defaultStatus: unaffected
}