[hudson.plugins:project-inheritance] Jenkins Project Inheritance Plugin vulnerable to cross site scripting

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-34787
• https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1919
• https://github.com/advisories/GHSA-3hx4-285w-v6mm