PT-2023-27400 · Jenkins · Jenkins Flaky Test Handler Plugin+1

Andrea Chiera · Publicado 2023-08-16 · Atualizado 2023-08-18 · CVE-2023-40342

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Flaky Test Handler Plugin versions 1.2.2 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability, which is exploitable by attackers able to control JUnit report file contents. This occurs because the plugin does not escape JUnit test contents when showing them on the Jenkins UI.

Recommendations For Jenkins Flaky Test Handler Plugin versions 1.2.2 and earlier, update to version 1.2.3 or later, which escapes JUnit test contents when showing them on the Jenkins UI, thus resolving the stored cross-site scripting (XSS) vulnerability.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-40342

GHSA-HV48-HGP6-XPQF

Produtos afetados

Jenkins

Jenkins Flaky Test Handler Plugin

Referências · 11

• https://t.me/cvenotify/56607 · Publicação no Telegram
• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3223 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40342 · Nota de Segurança
• https://twitter.com/CVEnew/status/1691822020663673139 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-hv48-hgp6-xpqf · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/08/16/3 · Nota
• https://t.me/cvenotify/56887 · Publicação no Telegram
• https://t.me/cvenotify/56801 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-40342 · Aviso do Fabricante
• https://t.me/cibsecurity/68652 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1691855986250711406 · Publicação no Twitter