CVE-2016-4988

MEDIUM6.1EPSS 0.09%

Cross-site Scripting in Jenkins Build Failure Analyzer plugin

Published: 5/13/2022Modified: 2/16/2024

Description

Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

Affected packages (1)

Maven/com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzerfrom 0, < 1.16.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-4988
WEBhttps://jenkins.io/security/advisory/2016-06-20
WEBhttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20