Jenkins Fortify Plugin HTML injection vulnerability
Date: 2023-08
Affected: maven/org.jenkins-ci.plugins:fortify
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-4303
CWE: CWE-79
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method. This results in an HTML injection vulnerability. Fortify Plugin 22.2.39 removes HTML tags from the error message.


Mitigations:

Architectural layers (MAESTRO):