GitHub Advisoryadvisory · Maven

GHSA-7w89-qqxx-c62r Cross-site Scripting in Jenkins Build Failure Analyzer plugin

MEDIUM Published 2022-05-13 Modified 2022-11-01 Official page ↗
Aliases
CVE-2016-4988
Ecosystem
Maven
Packages
com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-01

Affected packages

• Maven com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer: < 1.16.0 → fixed in 1.16.0

Description

Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

Related

Alias · CVE (1)

  • CVE-2016-4988 Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References