CVE-2023-43499 Jenkins Build Failure Analyzer Plugin Cross-site Scripting vulnerability

Medium 5.4 Published 20 Sep 2023 Updated 24 Sep 2024

Attackers with permission to create or update Failure Causes can inject malicious scripts into build logs, leading to stored XSS attacks against Jenkins users.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-43499?

CVE-2023-43499 is a medium-severity cross-site scripting vulnerability in Jenkins Build Failure Analyzer Plugin, published on 20 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.

Weakness: CWE-79

Which versions are affected by CVE-2023-43499?

2 open source packages ship an affected version, including com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer. It affects 1 product.

Package	Affected	Fixed in
`com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer` Maven	All versions	`2.4.2`
`com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer` Maven	All versions	`2.4.2`

Products include Jenkins Build Failure Analyzer.

How do I fix CVE-2023-43499?

Upgrade com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer to 2.4.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-43499 being exploited?

There is no known exploitation of CVE-2023-43499 in the wild and no public exploit code.

Sources

Also known as GHSA-262f-77q5-rqv6.