GitHub Advisoryadvisory · Maven

GHSA-wmxx-2pvr-x7j6 Jenkins Sonargraph Integration Plugin vulnerable to Stored Cross-site Scripting

HIGH Published 2023-06-14 Modified 2023-06-14 Official page ↗
Aliases
CVE-2023-35145
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:sonargraph-integration
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2023-06-14

Affected packages

• Maven org.jenkins-ci.plugins:sonargraph-integration: <= 5.0.1 (no fix yet)

Description

Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not correctly escape the file path and the project name for the Log file field form validation. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Related

Alias · CVE (1)

  • CVE-2023-35145 Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References