Описание
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.
Ссылки
- Mailing ListThird Party Advisory
- Vendor Advisory
- Mailing ListThird Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.4.2 (исключая)
cpe:2.3:a:jenkins:build_failure_analyzer:*:*:*:*:*:jenkins:*:*
EPSS
Процентиль: 43%
0.00521
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 8
github
почти 3 года назад
Jenkins Build Failure Analyzer Plugin Cross-site Scripting vulnerability
EPSS
Процентиль: 43%
0.00521
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-79