Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.

Build Failure Analyzer Plugin 1.27.1 escapes matching text in the affected form validation response.

Affected Packages

Maven com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

Affected versions: 0 (fixed in 1.27.1)

Related CVEs

CVE-2020-2244

Key Information

GHSA ID

GHSA-p5jh-8rxp-wqjj

Published

May 24, 2022 5:27 PM

Last Modified

December 20, 2022 10:38 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.