Jenkins BART Plugin vulnerable to cross-site scripting (XSS)

MEDIO 5.4CVE-2022-45387 · GHSA-j923-26c2-qq9p · Published 15/11/2022 · updated 17/06/2026

En resumen

CVE-2022-45387 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a org.jenkins-ci.plugins:bart, bart (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.66%, mayor que el 51.9% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:bart Maven	`≤ 1.0.3`	No fix yet
bart jenkins	`≤ 1.0.3`	No fix yet

Description

Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability. Currently, there are no known workarounds or patches available.

NVD description

Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2022-45387 · ADVISORY
jenkins-infra/update-center2#658 · WEB
jenkinsci/bart-plugin · PACKAGE
jenkinsci/bart-plugin · WEB
jenkins.io/security/advisory/2022-11-15 · WEB
openwall.com/lists/oss-security/2022/11/15/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free