Description

Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

Remediation

References

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20

https://jenkins.io/security/advisory/2016-06-20/

Related Vulnerabilities

CVE-2021-44521 Vulnerability in maven package org.apache.cassandra:cassandra-all

CVE-2023-46131 Vulnerability in maven package org.grails:grails-web-common

CVE-2015-0227 Vulnerability in maven package org.apache.wss4j:wss4j-ws-security-dom

CVE-2019-1003071 Vulnerability in maven package hudson.plugins.octopusdeploy:octopusdeploy

CVE-2022-31690 Vulnerability in maven package org.springframework.security:spring-security-oauth2-client

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory