PT-2023-6025 · Jenkins · Jenkins Fortify Plugin+1

Kevin Guerroudj · Publicado 2023-08-21 · Atualizado 2023-08-24 · CVE-2023-4303

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Fortify Plugin versions 22.1.38 and earlier

Description The issue is related to the failure to protect the web page structure, allowing a remote attacker to perform an HTML injection. This occurs because the error message for a form validation method is not properly escaped, resulting in an HTML injection vulnerability.

Recommendations For Jenkins Fortify Plugin versions 22.1.38 and earlier, update to version 22.2.39 or later, which removes HTML tags from the error message, thus resolving the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-06726

CVE-2023-4303

GHSA-223M-PGCQ-F3XG

Produtos afetados

Jenkins

Jenkins Fortify Plugin

Referências · 10

• https://github.com/jenkinsci/fortify-plugin/commit/357d7bfbcb0ff796ea7d078bee13159f1d000f5d · Nota
• https://github.com/jenkinsci/fortify-plugin · Nota
• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3140 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4303 · Nota de Segurança
• https://t.me/cvenotify/57034 · Publicação no Telegram
• https://t.me/cvenotify/57046 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-223m-pgcq-f3xg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-4303 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06726 · Nota de Segurança
• https://t.me/cvenotify/57228 · Publicação no Telegram