GHSA-ph74-8rgx-64c5

ghsaUSosv

Cross-site Scripting in Jenkins JUnit Plugin

view advisory published 2023-02-15Licence: CC-BY-4.0

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-25761US	medium5.4	0.70% (53rd)	—	2023-02-15
Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2023/02/15/4WEB
https://github.com/jenkinsci/junit-plugin/commit/d6b8042a06de4aaaf0942ad79036095b853eea02WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-25761ADVISORY
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan