Stored XSS vulnerability in Jenkins FindBugs Plugin

2022-05-2417:33:09

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin’s post build step.

CPENameOperatorVersion
org.jvnet.hudson.plugins:findbugseq4.4
org.jvnet.hudson.plugins:findbugseq4.16
org.jvnet.hudson.plugins:findbugseq3.1
org.jvnet.hudson.plugins:findbugseq2.9
org.jvnet.hudson.plugins:findbugseq3.9
org.jvnet.hudson.plugins:findbugseq3.0
org.jvnet.hudson.plugins:findbugseq3.7
org.jvnet.hudson.plugins:findbugseq2.7
org.jvnet.hudson.plugins:findbugseq2.5
org.jvnet.hudson.plugins:findbugseq2.2

Name	Operator	Version
org.jvnet.hudson.plugins:findbugs	eq	4.4
org.jvnet.hudson.plugins:findbugs	eq	4.16
org.jvnet.hudson.plugins:findbugs	eq	3.1
org.jvnet.hudson.plugins:findbugs	eq	2.9
org.jvnet.hudson.plugins:findbugs	eq	3.9
org.jvnet.hudson.plugins:findbugs	eq	3.0
org.jvnet.hudson.plugins:findbugs	eq	3.7
org.jvnet.hudson.plugins:findbugs	eq	2.7
org.jvnet.hudson.plugins:findbugs	eq	2.5
org.jvnet.hudson.plugins:findbugs	eq	2.2