PT-2023-24117 · Jenkins · Jenkins Testng Results Plugin+1

Valdes Che Zogou · Publicado 2023-05-16 · Atualizado 2023-05-25 · CVE-2023-32984

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins TestNG Results Plugin versions 730.v4c5283037693 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the plugin does not escape several values parsed from TestNG report files and displayed on the plugin's test information pages. This makes it exploitable by attackers who can provide a crafted TestNG report file.

Recommendations For Jenkins TestNG Results Plugin versions 730.v4c5283037693 and earlier, update to version 730.732.v959a 3a a eb a 72 or later, which escapes the affected values that are parsed from TestNG report files.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-32984

GHSA-H3HG-R97V-5R9W

Produtos afetados

Jenkins

Jenkins Testng Results Plugin

Referências · 6

• https://github.com/jenkinsci/testng-plugin-plugin/commit/5f3d83ca56c0657fc09af7ea70cfbdd691adeaab · Nota
• https://osv.dev/vulnerability/GHSA-h3hg-r97v-5r9w · Aviso do Fabricante
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3047 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32984 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32984 · Aviso do Fabricante
• https://t.me/cibsecurity/64230 · Publicação no Telegram