Jenkins BART Plugin vulnerable to cross-site scripting (XSS)

MOYENNE 5.4CVE-2022-45387 · GHSA-j923-26c2-qq9p · Published 15/11/2022 · updated 17/06/2026

En bref

CVE-2022-45387 est une vulnérabilité MOYENNE (CVSS 5.4) touchant org.jenkins-ci.plugins:bart, bart (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.66%, plus élevée que 51.9% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:bart Maven	`≤ 1.0.3`	No fix yet
bart jenkins	`≤ 1.0.3`	No fix yet

Description

Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability. Currently, there are no known workarounds or patches available.

NVD description

Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2022-45387 · ADVISORY
jenkins-infra/update-center2#658 · WEB
jenkinsci/bart-plugin · PACKAGE
jenkinsci/bart-plugin · WEB
jenkins.io/security/advisory/2022-11-15 · WEB
openwall.com/lists/oss-security/2022/11/15/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free