PT-2023-28845
CVE-2023-43499
·
تاريخ النشر
2023-09-20
·
تاريخ التحديث
2023-09-27
الوصف من
CVSS 3.1
8.0
عاليةالمقاييسAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier
Description
The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the Jenkins Build Failure Analyzer Plugin does not escape Failure Cause names in build logs. This makes it exploitable by attackers who can create or update Failure Causes.
Recommendations
For Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier, update to version 2.4.2 or later, which escapes Failure Cause names in build logs, to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾