GitHub Advisoryadvisory · Maven

GHSA-9c2p-99pg-c4j9 Persistent XSS vulnerability in Static Analysis Utilities

MEDIUM Published 2022-05-17 Modified 2024-01-30 Official page ↗
Aliases
CVE-2017-1000102
Ecosystem
Maven
Packages
org.jvnet.hudson.plugins:analysis-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-30

Affected packages

• Maven org.jvnet.hudson.plugins:analysis-core: < 1.92 → fixed in 1.92

Description

The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings (Warnings Plugin), could insert arbitrary HTML into this view.

Related

Alias · CVE (1)

  • CVE-2017-1000102 The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability:… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References