Jenkins Fortify Plugin HTML injection vulnerability

MOYENNE 6.1CVE-2023-4303 · GHSA-223m-pgcq-f3xg · Published 21/08/2023 · updated 17/06/2026

En bref

CVE-2023-4303 est une vulnérabilité MOYENNE (CVSS 6.1) touchant org.jenkins-ci.plugins:fortify, fortify (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.47%, plus élevée que 40.8% des vulnérabilités.
Correctif : mettre à jour vers 22.2.39 ou plus récent.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:fortify Maven	`< 22.2.39`	`22.2.39`
fortify jenkins	`< 22.2.39`	`22.2.39`

Description

Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method. This results in an HTML injection vulnerability.

Fortify Plugin 22.2.39 removes HTML tags from the error message.

NVD description

Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2023-4303 · ADVISORY
jenkinsci/fortify-plugin commit 357d7bf · WEB
jenkinsci/fortify-plugin · PACKAGE
jenkins.io/security/advisory/2023-08-16 · WEB

Autres vulnérabilités de org.jenkins-ci.plugins:fortify

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:fortify

Maven

< 22.2.39

22.2.39

fortify

jenkins

< 22.2.39

22.2.39

Description

Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method. This results in an HTML injection vulnerability.

Fortify Plugin 22.2.39 removes HTML tags from the error message.

NVD description

Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability.

Autres vulnérabilités de org.jenkins-ci.plugins:fortify

Tout voir →