PT-2023-24117 · Jenkins · Jenkins Testng Results Plugin+1

Valdes Che Zogou · Published 2023-05-16 · Updated 2023-05-25 · CVE-2023-32984

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins TestNG Results Plugin versions 730.v4c5283037693 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the plugin does not escape several values parsed from TestNG report files and displayed on the plugin's test information pages. This makes it exploitable by attackers who can provide a crafted TestNG report file.

Recommendations For Jenkins TestNG Results Plugin versions 730.v4c5283037693 and earlier, update to version 730.732.v959a 3a a eb a 72 or later, which escapes the affected values that are parsed from TestNG report files.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-32984

GHSA-H3HG-R97V-5R9W

Affected Products

Jenkins

Jenkins Testng Results Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-h3hg-r97v-5r9w · Vendor Advisory
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32984 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32984 · Vendor Advisory
• https://github.com/jenkinsci/testng-plugin-plugin/commit/5f3d83ca56c0657fc09af7ea70cfbdd691adeaab · Note
• https://t.me/cibsecurity/64230 · Telegram Post