GHSA-wmxx-2pvr-x7j6
GitHub Security Advisory
Jenkins Sonargraph Integration Plugin vulnerable to Stored Cross-site Scripting
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not correctly escape the file path and the project name for the Log file field form validation.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected Packages
Maven
org.jenkins-ci.plugins:sonargraph-integration
Affected versions:
0
(last affected: 5.0.1)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: August 24, 2025 6:28 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.