CVE-2023-35145

Summary

CVE-2023-35145 is a stored cross-site scripting (XSS) vulnerability affecting the Jenkins Sonargraph Integration Plugin version 5.0.1 and earlier. The issue stems from insufficient input validation, allowing attackers with Item/Configure permissions to inject malicious scripts into log file paths and project names. This vulnerability can result in the execution of malicious code on affected Jenkins instances, potentially leading to unauthorized access, data theft, or system damage. To mitigate this risk, it is recommended that users upgrade to the latest version of the plugin or implement input validation measures for log file paths and project names.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.