PT-2023-28845 · Jenkins · Jenkins Build Failure Analyzer Plugin+1

Yaroslav Afenkin · Publicado 2023-09-20 · Atualizado 2023-09-27 · CVE-2023-43499

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the Jenkins Build Failure Analyzer Plugin does not escape Failure Cause names in build logs. This makes it exploitable by attackers who can create or update Failure Causes.

Recommendations For Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier, update to version 2.4.2 or later, which escapes Failure Cause names in build logs, to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-43499

GHSA-262F-77Q5-RQV6

Produtos afetados

Jenkins

Jenkins Build Failure Analyzer Plugin

Referências · 10

• https://t.me/cibsecurity/70818 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1704530930923405810 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-43499 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2023-09-20/#SECURITY-3244 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-262f-77q5-rqv6 · Aviso do Fabricante
• https://t.me/cvenotify/58186 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1704572198692815203 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2023/09/20/5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43499 · Nota de Segurança
• https://twitter.com/fletch_ai/status/1706958623815918029 · Publicação no Twitter