GHSA-7p6g-gr9g-vfx6

ghsaUSosv

Jenkins LoadComplete support Plugin Cross-site Scripting vulnerability

view advisory published 2023-05-16Licence: CC-BY-4.0

Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name in its test result page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-33007US	medium5.4	0.46% (39th)	—	2023-05-16
Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attack…

references

External citations — patches, advisories, analysis.

https://nvd.nist.gov/vuln/detail/CVE-2023-33007ADVISORY
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2903WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan