high8.0
CVE-2023-35145
Jenkins Sonargraph Integration Plugin vulnerable to Stored Cross-site Scripting
Impact
Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not correctly escape the file path and the project name for the Log file field form validation. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:sonargraph-integration | <= 5.0.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Sonargraph Integration | through 5.0.1 |