CVE-2023-35145

2023-06-1412:53:08

jenkins

www.cve.org

jenkins

sonargraph integration

plugin

cross-site scripting

vulnerability

file path

project name

log file

validation

attackers

item/configure permission

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.6%

JSON

Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in a stored cross-site scripting vulnerability exploitable by attackers with Item/Configure permission.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Jenkins Sonargraph Integration Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "5.0.1",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]