GitHub Advisoryadvisory · Maven

GHSA-hv48-hgp6-xpqf Jenkins Flaky Test Handler Plugin stored cross-site scripting vulnerability

HIGH Published 2023-08-16 Modified 2023-08-16 Official page ↗
Aliases
CVE-2023-40342
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:flaky-test-handler
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2023-08-16

Affected packages

• Maven org.jenkins-ci.plugins:flaky-test-handler: < 1.2.3 → fixed in 1.2.3

Description

Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control JUnit report file contents. Flaky Test Handler Plugin 1.2.3 escapes JUnit test contents when showing them on the Jenkins UI.

Related

Alias · CVE (1)

  • CVE-2023-40342 Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References