5.4
Medium
CVE-2022-43420 Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the…
Description
Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control or modify Contrast service API responses.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Contrast Continuous Application Security Plugin 3.9 | earliest → 3.9 | No fix stated |
Other CVEs of Jenkins Contrast Continuous Application Security Plugin
The 4 CVEs of Jenkins Contrast Continuous Application Security Plugin →
CVE-2026-57299
Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers…
4.3
Medium
CVE-2026-57298
A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and…
5.4
Medium
CVE-2026-57297
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows…
5.4
Medium