CVE-2023-4303: Jenkins Fortify Plugin HTML injection vulnerability
Summary
CVE-2023-4303: Jenkins Fortify Plugin HTML injection vulnerability. Affects org.jenkins-ci.plugins:fortify versions < 22.2.39. Fixed in 22.2.39. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Fortify Plugin is a Maven package that provides integration with Fortify, a software security tool. It allows users to scan their Jenkins projects for security vulnerabilities and generate reports. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins Fortify Plugin version 22.1.38 and earlier is vulnerable to an HTML injection attack. The error message for a form validation method is not properly escaped, allowing an attacker to inject malicious HTML code. This vulnerability can be exploited by an attacker to perform various attacks, such as phishing, cross-site scripting (XSS), and defacement of the Jenkins interface. The impact of this vulnerability is moderate, with a CVSS score of 4.3.
How To Fix
Minimum fixed version
22.2.39
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The Jenkins Fortify Plugin version 22.1.38 and earlier is vulnerable to an HTML injection attack. To mitigate this vulnerability, it is crucial to upgrade to version 22.2.39 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:fortify →
FAQ
The Jenkins Fortify Plugin is a Maven package that integrates Jenkins with Fortify, a software security tool. It allows users to scan their Jenkins projects for security vulnerabilities and generate reports.
HTML injection, also known as cross-site scripting (XSS), is a web security vulnerability that allows an attacker to inject malicious HTML code into a website or web application. This can lead to various attacks, such as phishing, session hijacking, and defacement of the website.
This vulnerability allows an attacker to inject malicious HTML code into the Jenkins Fortify Plugin, potentially leading to attacks such as phishing, cross-site scripting (XSS), and defacement of the Jenkins interface.
To fix this vulnerability, it is recommended to upgrade to Jenkins Fortify Plugin version 22.2.39 or later. This version removes HTML tags from the error message, preventing the injection of malicious code.
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:fortify.
