CVE-2016-3101: Jenkins Extra Columns Plugin allows Cross-Site Scripting (XSS)

May 13, 2022 (updated March 13, 2025)

Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter.

References

github.com/advisories/GHSA-mr4j-7jjv-24m7
github.com/jenkinsci/extra-columns-plugin
github.com/jenkinsci/extra-columns-plugin/commit/028ee0b324299271e7c244f8cb5cc9c4a87c72cf
nvd.nist.gov/vuln/detail/CVE-2016-3101
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11

Code Behaviors & Features

Detect and mitigate CVE-2016-3101 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →