GHSA-ph74-8rgx-64c5

Cross-site Scripting in Jenkins JUnit Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-25761

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:junit	< 1166.1168.vd6b_8042a_06de	1166.1168.vd6b_8042a_06de

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-25761 advisory
https://github.com/jenkinsci/junit-plugin/commit/d6b8042a06de4aaaf0942ad79036095b853eea02 web
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032 web
http://www.openwall.com/lists/oss-security/2023/02/15/4 web