CVE-2023-43499: Jenkins Build Failure Analyzer Plugin Cross-site Scripting vulnerability
Summary
CVE-2023-43499: Jenkins Build Failure Analyzer Plugin Cross-site Scripting vulnerability. Affects com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer versions < 2.4.2. Fixed in 2.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Build Failure Analyzer Plugin is a Maven package developed by com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer. It is designed to analyze build failures in Jenkins and provide insights into the causes of these failures. The plugin allows users to define Failure Causes and associate them with specific build failures. These Failure Causes are then logged in the build logs for reference and analysis.
Vulnerability Detail
The Jenkins Build Failure Analyzer Plugin version 2.4.1 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin fails to properly escape Failure Cause names in build logs, allowing attackers with the ability to create or update Failure Causes to inject malicious scripts. This vulnerability can be exploited by an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized actions or data theft. The issue has been addressed in version 2.4.2 of the plugin, which properly escapes Failure Cause names in build logs.
How To Fix
Minimum fixed version
2.4.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to version 2.4.2 is the recommended solution.
Conclusion
The Jenkins Build Failure Analyzer Plugin version 2.4.1 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. Users should upgrade to version 2.4.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer →
FAQ
This vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized actions or data theft.
Users of Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, this vulnerability has been fixed in version 2.4.2 of the Jenkins Build Failure Analyzer Plugin.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer.
