CVE-2023-46659

Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Published: Oct 25, 2023
Updated: May 10, 2024
CVE: CVE-2023-46659
GHSA: GHSA-jwx3-2hq3-682c
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
org.jenkins-ci.plugins / trac	-	1.13.x
jenkins / edgewall_trac	-	1.13.x

http://www.openwall.com/lists/oss-security/2023/10/25/2
https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3247

Vulnerability Database

289,784

CVE-2023-46659