Stored Cross-Site Scripting Flaw in Jenkins Sonargraph Integration Plugin
CVE-2023-35145

5.4MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Sonargraph Integration Plugin
Vendor
CVE Published:
14 June 2023

Summary

The Jenkins Sonargraph Integration Plugin allows for a stored cross-site scripting vulnerability due to inadequate escaping of the file path and project name fields within the Log file field form validation. This oversight enables attackers with Item/Configure permissions to exploit the vulnerability, potentially leading to malicious script execution in the context of users who interact with the affected functionality.

Affected Version(s)

Jenkins Sonargraph Integration Plugin 0 <= 5.0.1

References

https://www.jenkins.io/security/advisory/2023-06-14/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/06/14/5

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.