CVE-2024-28150

Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins:php (1.0) +1 more potentially affected by CVE-2024-28150 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.0.0, =1.0.18 Source cves: CVE-2024-28150 Source advisory: MEND:CVE-2024-28150...

CVE-2024-28150

The Jenkins HTML Publisher Plugin (version 1.32 and earlier ) is vulnerable to stored cross-site scripting (XSS) . The root cause is a lack of proper input sanitization and escaping for job names , report names , and index page titles displayed within the report frame. Specifically, the publishRe...