CVE-2023-46659

5.4MEDIUM

Key Information

Vendor: Jenkins
Status: Jenkins Edgewall Trac Plugin
Vendor: CVE Published:; 25 October 2023

Summary

Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected Version(s)

Jenkins Edgewall Trac Plugin <= 1.13

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published.
Oct 25, 2023
Vulnerability Reserved.
Oct 24, 2023

Collectors

NVD DatabaseMitre Database