Build Failure Analyzer vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

BF

Product

Build Failure Analyzer

by Jenkins · last CVE Sep 20, 2023

9

CVEs

0

On KEV

8.8

Max CVSS

0

New 30D

Vulnerabilities9 In the news0 Timeline

Severity mix

Critical 0High 2Medium 7Low 0

Severity

All severities9 Critical0 High2 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Build Failure Analyzer to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-43500	8.8	0%	Sep 20	A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port… Affected: before 2.4.2
CVE-2019-16553	8.8	1%	Dec 17	A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive… Affected: through 1.24.1
CVE-2023-43501	6.5	1%	Sep 20	A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname… Affected: before 2.4.2
CVE-2019-16555	6.5	1%	Dec 17	A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins… Affected: through 1.24.1
CVE-2016-4988	6.1	1%	Feb 9	Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an… Affected: before 1.16.0
CVE-2023-43499	5.4	1%	Sep 20	Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability… Affected: before 2.4.2
CVE-2020-2244	5.4	1%	Sep 1	Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability… Affected: through 1.27.0
CVE-2023-43502	4.3	0%	Sep 20	A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes Affected: before 2.4.2
CVE-2019-16554	4.3	1%	Dec 17	A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally… Affected: through 1.24.1