description: Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.
affected:
{
defaultStatus: unaffected
product: Jenkins Build Failure Analyzer Plugin
vendor: Jenkins Project
versions:
lessThanOrEqual: 2.4.1, status: affected, version: 0, versionType: maven
}