GHSA-f799-hfg3-48jp

GitHub Security Advisory

Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin

✓ GitHub Reviewed MODERATE Has CVE

Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation.

This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Job/Configure permission.

Sonargraph Integration Plugin 3.0.1 escapes the affected part of the error message.

Maven org.jenkins-ci.plugins:sonargraph-integration

Affected versions: 0 (fixed in 3.0.1)

CVE-2020-2201

GHSA ID

GHSA-f799-hfg3-48jp

Published

May 24, 2022 5:22 PM

Last Modified

December 28, 2022 11:50 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:sonargraph-integration

GitHub Reviewed

✓ Yes

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.