PT-2023-20285 · Jenkins · Jenkins Junit Plugin+1

Kevin Guerroudj · Published 2023-02-15 · Updated 2025-03-19 · CVE-2023-25761

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins JUnit Plugin versions 1166.va 436e268e972 and earlier

Description The issue results from the plugin not escaping test case class names in JavaScript expressions, leading to a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can control test case class names in the JUnit resources processed by the plugin.

Recommendations For Jenkins JUnit Plugin versions 1166.va 436e268e972 and earlier, update to a version that escapes test case class names in JavaScript expressions to prevent stored cross-site scripting (XSS) attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-25761

GHSA-PH74-8RGX-64C5

RHSA-2023:1866

RHSA-2023:3195

RHSA-2023:3198

RHSA-2023:3299

RHSA-2023:6171

RHSA-2023:6172

RHSA-2023:6179

RHSA-2023:7288

RHSA-2024:0775

RHSA-2024:0776

RHSA-2024:0777

RHSA-2024:0778

Affected Products

Jenkins

Jenkins Junit Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-ph74-8rgx-64c5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25761 · Security Note
• https://jenkins.io/security/advisory/2023-02-15/#SECURITY-3032 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25761 · Vendor Advisory
• https://github.com/jenkinsci/junit-plugin/commit/d6b8042a06de4aaaf0942ad79036095b853eea02 · Note
• https://t.me/cvenotify/44340 · Telegram Post
• https://t.me/cvenotify/115354 · Telegram Post
• http://openwall.com/lists/oss-security/2023/02/15/4 · Note
• https://t.me/cibsecurity/58225 · Telegram Post