PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4988 Jenkins CVE debrief

CVE-2016-4988 is a cross-site scripting issue in the Jenkins Build Failure Analyzer plugin before version 1.16.0. A remote attacker can inject arbitrary web script or HTML through an unspecified parameter, creating risk for users who view the affected content in Jenkins. The issue was publicly referenced in the Jenkins Security Advisory dated 2016-06-20 and later published in NVD as CVE-2016-4988.

Vendor
Jenkins
Product
Build Failure Analyzer
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

Jenkins administrators, security teams, and anyone running the Build Failure Analyzer plugin on versions earlier than 1.16.0 should treat this as relevant. Any environment where users can view plugin-generated pages or content in Jenkins is in scope.

Technical summary

NVD classifies this issue as CWE-79 (Cross-site Scripting) with CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, scored 6.1 (Medium). The vulnerable component is the Jenkins Build Failure Analyzer plugin, affected before 1.16.0. The flaw allows a remote attacker to inject arbitrary web script or HTML via an unspecified parameter; user interaction is required for impact.

Defensive priority

Medium priority. The issue is network-reachable and can affect confidentiality and integrity, but it requires user interaction and is limited to installations using the vulnerable plugin version.

Recommended defensive actions

  • Upgrade the Jenkins Build Failure Analyzer plugin to version 1.16.0 or later.
  • Confirm which Jenkins instances have the Build Failure Analyzer plugin installed and verify the version in use.
  • Review any Jenkins pages or plugin output that render user-controlled input and ensure proper output encoding is in place.
  • Use the Jenkins vendor advisory to validate remediation steps and confirm the vulnerable component is no longer deployed.

Evidence notes

The supplied NVD record identifies the affected CPE as jenkins:build_failure_analyzer with versionEndExcluding 1.16.0 and maps the weakness to CWE-79. NVD also links the Jenkins Security Advisory 2016-06-20 as the vendor advisory. Per the supplied timeline, the CVE was published on 2017-02-09 and last modified on 2026-05-13.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-4988 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-4988

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-4988 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-4988

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.