A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

Affected Packages

Maven org.6wind.jenkins:lockable-resources

Affected versions: 0 (fixed in 2.5)

Related CVEs

CVE-2019-1003042

Key Information

GHSA ID

GHSA-wqjj-c9cx-q7cf

Published

May 13, 2022 1:25 AM

Last Modified

January 9, 2024 10:34 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.6wind.jenkins:lockable-resources

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 1, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.