GHSA-p5jh-8rxp-wqjj

XSS vulnerability in Jenkins Build Failure Analyzer Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2020-2244

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer	< 1.27.1	1.27.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications. Build Failure Analyzer Plugin 1.27.1 escapes matching text in the affected form validation response.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2244 advisory
https://github.com/jenkinsci/build-failure-analyzer-plugin/commit/c974938f213df0109269cb1b4508b8a1ec19f0ff web
https://github.com/jenkinsci/build-failure-analyzer-plugin package
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1770 web
http://www.openwall.com/lists/oss-security/2020/09/01/3 web