Cross site scripting

2023-09-2017:15:00

PRIOn knowledge base

www.prio-n.com

jenkins

build failure

analyzer plugin

stored xss

cross-site scripting

vulnerability

attackers

0.001 Low

EPSS

Percentile

38.6%

JSON

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.

CPENameOperatorVersion
build_failure_analyzerlt2.4.2

CPE	Name	Operator	Version
	build_failure_analyzer	lt	2.4.2

References

www.openwall.com/lists/oss-security/2023/09/20/5

www.jenkins.io/security/advisory/2023-09-20/

0.001 Low

EPSS

Percentile

38.6%

JSON

Related for PRION:CVE-2023-43499