Jenkins GitHub Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Jenkins GitHub Plugin, affecting versions through 1.46.0. This vulnerability arises from improper processing of the current job URL in JavaScript validation for the 'GitHub hook trigger for GITScm polling' feature. As a result, non-anonymous attackers with Overall/Read permission can exploit this issue.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where the injected script is executed in the context of the user.

Remediation

Users of the Jenkins GitHub Plugin should update to version 1.46.0.1, which addresses the vulnerability by properly processing the job URL in the validation feature.