A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.
CVSS 3.0MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.00842·Published 2019-01-09·Fixed in 2.18.1CWE-79