Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.jenkins-ci.plugins:gatling

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1MavenPublished

    XSS vulnerability in Jenkins Gatling Plugin

    CVE-2020-2173 · GHSA-hv53-qjg6-5pm9

    Affected
    • Maven org.jenkins-ci.plugins:gatling <= 1.2.7
    Fixed in
    1.3.0· Vendor fix available
    Issue
    Gatling Plugin 1.2.7 and earlier serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625.3. This results in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content. Gatling Plugin 1.3.0 no longer allows viewing Gatling reports directly in Jenkins. Instead users need to download an archive containing the report.

    Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →