[org.jenkins-ci.plugins:matrix-auth] Improper Neutralization of Input During Web Page Generation in Jenkins Matrix Authorization Strategy Plugin

Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-2226
• https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1909
• http://www.openwall.com/lists/oss-security/2020/07/15/5
• https://github.com/advisories/GHSA-vr6v-wjfw-rxcr