{"id":"CVE-2016-4988","details":"Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.","aliases":["GHSA-7w89-qqxx-c62r"],"modified":"2026-07-08T12:52:51.668218Z","published":"2017-02-09T15:59:01.097Z","references":[{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2016-06-20/"},{"type":"ADVISORY","url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/build-failure-analyzer-plugin","events":[{"introduced":"0"},{"fixed":"098283a535f392869330705d0adbb16efb616f82"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:jenkins:build_failure_analyzer:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.16.0"}]}}],"versions":["build-failure-analyzer-1.15.0","build-failure-analyzer-1.14.0","build-failure-analyzer-1.13.5","build-failure-analyzer-1.13.4","build-failure-analyzer-1.13.3","build-failure-analyzer-1.13.2","build-failure-analyzer-1.13.1","build-failure-analyzer-1.13.0","build-failure-analyzer-1.12.1","build-failure-analyzer-1.12.0","build-failure-analyzer-1.11.0","build-failure-analyzer-1.10.3","build-failure-analyzer-1.10.2","build-failure-analyzer-1.10.1","build-failure-analyzer-1.10.0-2","build-failure-analyzer-1.10.0","build-failure-analyzer-1.9.1","build-failure-analyzer-1.9.0","build-failure-analyzer-1.8.1","build-failure-analyzer-1.8.0","build-failure-analyzer-1.7.0","build-failure-analyzer-1.6.0","build-failure-analyzer-1.5.1","build-failure-analyzer-1.5.0","build-failure-analyzer-1.4.1","build-failure-analyzer-1.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4988.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}