CVE-2023-35145

MediumCVSS 5.4

Published: 14/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

46th percentile - higher than 46% of all known CVEs

Summary

Jenkins Sonargraph Integration Plugin version 5.0.1 and earlier does not escape the file path and project name for the Log file field form validation, leading to a stored cross-site scripting vulnerability.

Risk Assessment

Attackers with Item/Configure permissions can exploit this vulnerability to inject malicious code, potentially leading to data theft or system takeover.

Recommendation

It is recommended to update the plugin to the latest version that fixes this vulnerability and review user permissions to limit access to critical functions.

Original NVD description (English source)

Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in a stored cross-site scripting vulnerability exploitable by attackers with Item/Configure permission.