CVE-2023-28669

Summary: Jenkins JaCoCo Plugin versions 3.3.2 and earlier are vulnerable to stored XSS due to failure to escape class and method names in the UI. The vulnerability is exploitable by attackers who can control input files used by the ‘Record JaCoCo coverage report’ post-build action. A fix exists i...