CVE-2023-43502: Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability
Summary
CVE-2023-43502: Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability. Affects com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer versions < 2.4.2. Fixed in 2.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Build Failure Analyzer Plugin is a Maven package developed by com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer. It is designed to analyze build failures in Jenkins and provide insights into the causes of these failures. The plugin allows users to define failure causes and take appropriate actions to resolve them.
Vulnerability Detail
The Jenkins Build Failure Analyzer Plugin version 2.4.1 and earlier is vulnerable to cross-site request forgery (CSRF) attacks. This vulnerability arises from the plugin not requiring POST requests for an HTTP endpoint. As a result, attackers can exploit this vulnerability to perform unauthorized actions, such as deleting Failure Causes. The impact of this vulnerability can lead to the manipulation or deletion of failure causes, potentially disrupting the build analysis process.
How To Fix
Latest published version: 3.889.vda_d3b_30435fc as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can consider implementing additional security measures such as enforcing CSRF protection at the network or application level to mitigate the risk of CSRF attacks.
Conclusion
The Jenkins Build Failure Analyzer Plugin version 2.4.1 and earlier is vulnerable to a CSRF attack, allowing unauthorized actions such as deleting Failure Causes. To mitigate this vulnerability, users should upgrade to version 2.4.2 or later of the plugin. It is important to promptly apply the fix to ensure the integrity of the build analysis process. For additional support, please contact DevNack.com.
See every vulnerability recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer →
FAQ
This vulnerability allows attackers to perform unauthorized actions, such as deleting Failure Causes in the Jenkins Build Failure Analyzer Plugin. It can potentially disrupt the build analysis process and compromise the integrity of the analysis results.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
There are no known exploits for this vulnerability at the time of this report. However, it is important to promptly apply the recommended fix to mitigate the risk of potential attacks.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
