Cross-site Scripting (XSS)

2023-06-2609:04:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sonargraph integration jenkins plugin

cross-site scripting

xss

dochecklogfile function

sonargraphreportbuilder.java

form validation

arbitrary javascript

vulnerability

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

40.6%

JSON

Sonargraph Integration Jenkins Plugin is vulnerable to Cross-site Scripting (XSS). The vulnerability exists in doCheckLogFile function in SonargraphReportBuilder.java because it fails to escape the file path and the project name for the Log file field form validation which allows an attacker to inject and execute arbitrary javascript.

CPENameOperatorVersion
sonargraph integration jenkins pluginle5.0.2
sonargraph integration jenkins pluginle1.0.4
sonargraph integration jenkins pluginle5.0.2
sonargraph integration jenkins pluginle1.0.4

Name	Operator	Version
sonargraph integration jenkins plugin	le	5.0.2
sonargraph integration jenkins plugin	le	1.0.4
sonargraph integration jenkins plugin	le	5.0.2
sonargraph integration jenkins plugin	le	1.0.4