PT-2023-20285 · Jenkins · Jenkins Junit Plugin+1

Kevin Guerroudj · Publicado 2023-02-15 · Atualizado 2025-03-19 · CVE-2023-25761

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins JUnit Plugin versions 1166.va 436e268e972 and earlier

Description The issue results from the plugin not escaping test case class names in JavaScript expressions, leading to a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can control test case class names in the JUnit resources processed by the plugin.

Recommendations For Jenkins JUnit Plugin versions 1166.va 436e268e972 and earlier, update to a version that escapes test case class names in JavaScript expressions to prevent stored cross-site scripting (XSS) attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-25761

GHSA-PH74-8RGX-64C5

RHSA-2023:1866

RHSA-2023:3195

RHSA-2023:3198

RHSA-2023:3299

RHSA-2023:6171

RHSA-2023:6172

RHSA-2023:6179

RHSA-2023:7288

RHSA-2024:0775

RHSA-2024:0776

RHSA-2024:0777

RHSA-2024:0778

Produtos afetados

Jenkins

Jenkins Junit Plugin

Referências · 9

• https://github.com/jenkinsci/junit-plugin/commit/d6b8042a06de4aaaf0942ad79036095b853eea02 · Nota
• https://osv.dev/vulnerability/GHSA-ph74-8rgx-64c5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25761 · Nota de Segurança
• https://t.me/cvenotify/44340 · Publicação no Telegram
• https://jenkins.io/security/advisory/2023-02-15/#SECURITY-3032 · Aviso do Fabricante
• https://t.me/cvenotify/115354 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/02/15/4 · Nota
• https://osv.dev/vulnerability/CVE-2023-25761 · Aviso do Fabricante
• https://t.me/cibsecurity/58225 · Publicação no Telegram