Can someone delete https://plugins.jenkins.io/packageversion/

[Gavin Mogan]

26 installs, xss warning and still targeting 1.x. It showed up when I looked up plugins for "version"

and I was wondering why we are keeping it around?

Gavin

[Alexander Brandes]

I don't think one XSS vulnerability in a plugin with 26 installations is impactful enough to justify a suspension of the plugin.

Someone may always adopt the plugin to modernize it and mitigate the vulnerability.

[Daniel Beck]

On Tue, Feb 21, 2023 at 12:08 AM Alexander Brandes <mc.ca...@gmail.com> wrote:

impactful enough to justify a suspension of the plugin

In particular, exploitation requires the parameter to be shown on a view that doesn't mitigate the vulnerability, of which there are few. There's a good chance nobody is actually affected by this vulnerability.