GitHub Advisoryadvisory · Maven

GHSA-h3hg-r97v-5r9w Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability

MEDIUM Published 2023-05-16 Modified 2024-01-05 Official page ↗
Aliases
CVE-2023-32984
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:testng-plugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-05-17

Affected packages

• Maven org.jenkins-ci.plugins:testng-plugin: < 730.732.v959a → fixed in 730.732.v959a

Description

Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin’s test information pages. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file. TestNG Results Plugin 730.732.v959a_3a_a_eb_a_72 escapes the affected values that are parsed from TestNG report files.

Related

Alias · CVE (1)

  • CVE-2023-32984 Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References