Lucene search

Veracode Vulnerability DatabaseVERACODE:45822

HistoryMar 11, 2024 - 5:22 a.m.

Cross-site Scripting (XSS)

2024-03-1105:22:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

xss vulnerability

jenkins

htmlpublisher

input sanitization

malicious scripts

item/configure permission

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

org.jenkins-ci.plugins, htmlpublisher is vulnerable to Cross-Site Scripting. The vulnerability is due to publishReports function within HtmlPublisher.java not having proper input sanitization, This flow allows attackers with Item/Configure permission to inject malicious scripts into job names, report names, and index page titles displayed as part of the report frame.

CPENameOperatorVersion
html publisher pluginle1.32
html publisher pluginle1.32

CPE	Name	Operator	Version
	html publisher plugin	le	1.32
	html publisher plugin	le	1.32

References

www.openwall.com/lists/oss-security/2024/03/06/3

github.com/advisories/GHSA-xrrw-9j78-hpf3

github.com/jenkinsci/htmlpublisher-plugin/commit/c0eed940e65ea90f9b5ba21aa3d953546d5cd8ad

www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3302