GitHub Advisoryadvisory · Maven

GHSA-xrrw-9j78-hpf3 Jenkins HTML Publisher Plugin Stored XSS vulnerability

HIGH Published 2024-03-06 Modified 2024-11-22 Official page ↗
Aliases
CVE-2024-28150
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:htmlpublisher
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2024-03-06

Affected packages

• Maven org.jenkins-ci.plugins:htmlpublisher: < 1.32.1 → fixed in 1.32.1

Description

Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Related

Alias · CVE (1)

  • CVE-2024-28150 Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References