[org.jenkins-ci.plugins:queue-cleanup] Reflected XSS vulnerability in Jenkins Queue cleanup Plugin

A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability (XSS).

Queue cleanup Plugin 1.4 correctly escapes the query parameter.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-2169
• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724
• http://www.openwall.com/lists/oss-security/2020/03/25/2
• https://github.com/advisories/GHSA-m7pr-m4cx-6m22