CVE-2016-4988: Cross-site Scripting in Jenkins Build Failure Analyzer plugin
Summary
CVE-2016-4988: Cross-site Scripting in Jenkins Build Failure Analyzer plugin. Affects com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer versions < 1.16.0. Fixed in 1.16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Build Failure Analyzer plugin is a component of Jenkins, an open-source automation server. It provides analysis and diagnosis of build failures in Jenkins. The plugin allows users to define patterns and actions to be taken when a build failure matches a specific pattern. This plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Build Failure Analyzer plugin before version 1.16.0 in Jenkins is vulnerable to cross-site scripting (XSS) attacks. This vulnerability allows remote attackers to inject arbitrary web script or HTML into the plugin via an unspecified parameter. An attacker could exploit this vulnerability to execute malicious code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 3.889.vda_d3b_30435fc as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of the plugin as soon as possible.
Conclusion
The Build Failure Analyzer plugin in Jenkins is vulnerable to cross-site scripting (XSS) attacks. It is crucial to upgrade to version 1.16.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer →
FAQ
This vulnerability allows remote attackers to execute arbitrary web script or HTML in the context of a user's browser. It could lead to unauthorized access, data theft, or other malicious activities.
No, authentication is not required. Remote attackers can exploit this vulnerability without any authentication.
There are no known public exploits for this vulnerability at the time of this report.
Yes, this vulnerability has been fixed in version 1.16.0 of the Build Failure Analyzer plugin.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-7w89-qqxx-c62r.
Related vulnerabilities
Recent vulnerabilities recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer.
