CVE-2013-6374

Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Published Bysecalert@redhat.com

Published DateNov 25, 2013, 19:55

Affected Versions(1)

com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer(Maven)

Introduced0

Fixed1.5.1

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer(Maven)	0	1.5.1	N/A

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

3.5

Vector String

AV:N/AC:M/Au:S/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE

References

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

3.5

Vector String

AV:N/AC:M/Au:S/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE