CVE-2023-4303
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Jenkins Fortify Plugin version 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious HTML code, potentially leading to data theft or user interface manipulation.
Recommendation
It is recommended to update the Fortify plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in Jenkins Fortify Plugin
See all- CVE-2023-4302Medium
A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
- CVE-2023-4301Medium
The Fortify Plugin in Jenkins version 22.1.38 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using credentials IDs obtained through another method.
Original NVD description (English source)
Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS