Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method. This results in an HTML injection vulnerability.

Fortify Plugin 22.2.39 removes HTML tags from the error message.

Affected Packages

Maven org.jenkins-ci.plugins:fortify

Affected versions: 0 (fixed in 22.2.39)

Related CVEs

CVE-2023-4303

Key Information

GHSA ID

GHSA-223m-pgcq-f3xg

Published

August 22, 2023 12:31 AM

Last Modified

August 22, 2023 5:56 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:fortify

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.