high8.0
CVE-2024-28150
Jenkins HTML Publisher Plugin Stored XSS vulnerability
Impact
Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:htmlpublisher | < 1.32.1 | 1.32.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Html Publisher | before 1.32.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2024/03/06/3
- https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3302
- https://github.com/advisories/GHSA-xrrw-9j78-hpf3
- https://nvd.nist.gov/vuln/detail/CVE-2024-28150
- https://github.com/jenkinsci/htmlpublisher-plugin/commit/c0eed940e65ea90f9b5ba21aa3d953546d5cd8ad