Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
{
"versions": [
{
"introduced": "0"
},
{
"fixed": "2.32.2"
},
{
"introduced": "0"
},
{
"fixed": "2.44"
}
]
}