Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin

2022-05-2417:22:18

Google

osv.dev

0.001 Low

EPSS

Percentile

22.3%

JSON

Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation.

This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Job/Configure permission.

Sonargraph Integration Plugin 3.0.1 escapes the affected part of the error message.

CPENameOperatorVersion
org.jenkins-ci.plugins:sonargraph-integrationeq1.1.3
org.jenkins-ci.plugins:sonargraph-integrationeq1.0.3
org.jenkins-ci.plugins:sonargraph-integrationeq3.0.0
org.jenkins-ci.plugins:sonargraph-integrationeq2.2.2
org.jenkins-ci.plugins:sonargraph-integrationeq1.0.2
org.jenkins-ci.plugins:sonargraph-integrationeq2.0.1
org.jenkins-ci.plugins:sonargraph-integrationeq2.0.2
org.jenkins-ci.plugins:sonargraph-integrationeq2.1.0
org.jenkins-ci.plugins:sonargraph-integrationeq2.1.2
org.jenkins-ci.plugins:sonargraph-integrationeq2.2.1

Name	Operator	Version
org.jenkins-ci.plugins:sonargraph-integration	eq	1.1.3
org.jenkins-ci.plugins:sonargraph-integration	eq	1.0.3
org.jenkins-ci.plugins:sonargraph-integration	eq	3.0.0
org.jenkins-ci.plugins:sonargraph-integration	eq	2.2.2
org.jenkins-ci.plugins:sonargraph-integration	eq	1.0.2
org.jenkins-ci.plugins:sonargraph-integration	eq	2.0.1
org.jenkins-ci.plugins:sonargraph-integration	eq	2.0.2
org.jenkins-ci.plugins:sonargraph-integration	eq	2.1.0
org.jenkins-ci.plugins:sonargraph-integration	eq	2.1.2
org.jenkins-ci.plugins:sonargraph-integration	eq	2.2.1