GHSA-j923-26c2-qq9p

Jenkins BART Plugin vulnerable to cross-site scripting (XSS)

Source: GitHub Advisory Database (reviewed) High CVE-2022-45387

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:bart	<= 1.0.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability. Currently, there are no known workarounds or patches available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-45387 advisory
https://github.com/jenkins-infra/update-center2/pull/658 web
https://github.com/jenkinsci/bart-plugin package
https://github.com/jenkinsci/bart-plugin/blob/30d19e0ded8588c84601c7ffbcd0dd91c08ef945/src/main/java/org/jenkinsci/plugins/bart/LogParserBui… web
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2802 web
http://www.openwall.com/lists/oss-security/2022/11/15/4 web