GHSA-262f-77q5-rqv6HighCVSS 8.0

Jenkins Build Failure Analyzer Plugin Cross-site Scripting vulnerability

Published
September 20, 2023
Last Modified
November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-43499 →

📋 Description

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.

Build Failure Analyzer Plugin 2.4.2 escapes Failure Cause names in build logs.

🎯 Affected products1

  • maven/com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer:< 2.4.2

🔗 References (4)