CVE-2023-43499

—

CVSS 3.1

5.4 medium

EPSS

<1%p43

Published

Sep 20, 2023 (Sep 20, 2023)

Modified

Jun 17, 2026

Description

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.

Vendors: jenkins
Products: build failure analyzer
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.