CVE-2023-40342 — Cross-site Scripting in Project Jenkins Flaky Test Handler Plugin

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
4.7%
top 10.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Flaky Test Handler PluginJenkins Flaky Test Handler
Timeline
PublishedAug 16

Description

Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control JUnit report file contents.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

3
CVEList
CVE-2023-40342: Jenkins Flaky Test Handler Plugin 1↗2023-08-16
▶
GHSA
Jenkins Flaky Test Handler Plugin stored cross-site scripting vulnerability↗2023-08-16
▶
OSV
Jenkins Flaky Test Handler Plugin stored cross-site scripting vulnerability↗2023-08-16
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2023-08-16↗2023-08-16
▶
CVE-2023-40342 — Cross-site Scripting | cvebase