CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2023-35145
Medium (5.4) in jenkins sonargraph integration. EPSS 0.7% chance of exploitation in the next 30 days.
Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in a stored cross-site scripting vulnerability exploitable by attackers with Item/Configure permission.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:sonargraph_integration
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wmxx-2pvr-x7j6 | Maven | org.jenkins-ci.plugins:sonargraph-integration | <=5.0.1 | no fix published |