~ / search / GHSA-j927-269r-96xw

GHSA-j927-269r-96xw

Jenkins Cppcheck Plugin vulnerable to stored cross-site scripting (XSS)

Source: GitHub Advisory Database (reviewed) High CVE-2023-28678

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:cppcheck <= 1.26 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents.

References

External links from the advisory. They lead to third-party sites.