HTML injection vulnerability in Fortify Plugin

CVE-2023-4303

4.3MEDIUM

Key Information

Vendor: Jenkins
Status: Jenkins Fortify Plugin
Vendor: CVE Published:; 21 August 2023

Summary

Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability.

Affected Version(s)

Jenkins Fortify Plugin <= 22.1.38

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Timeline

Risk change from: 6.1 to: 4.3 - (MEDIUM)
Oct 1, 2024
Vulnerability published.
Aug 21, 2023
Vulnerability Reserved.
Aug 10, 2023

Collectors

NVD DatabaseMitre Database

Credit

Kevin Guerroudj, CloudBees, Inc.

.