VulnerabilityModified
CVE-2023-35145
Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in a stored cross-site scripting vulnerability exploitable by attackers with Item/Configure…
MEDIUM 5.4EPSS 0.66%
Does this matter?
Lower severity and a low EPSS score (0.66%). Track it; it rarely justifies an emergency change on its own.
Description
Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in a stored cross-site scripting vulnerability exploitable by attackers with Item/Configure permission.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.66% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- jenkins/sonargraph integration
- Source
- jenkinsci-cert@googlegroups.com
References
- http://www.openwall.com/lists/oss-security/2023/06/14/5Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3155Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/06/14/5Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3155Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.