PT-2024-2109 · Jenkins · Jenkins Html Publisher Plugin+1

Kevin Guerroudj · Published 2024-03-06 · Updated 2025-05-06 · CVE-2024-28150

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins HTML Publisher Plugin versions 1.32 and earlier

Description The issue exists due to the lack of protection for the web page structure. This can be exploited by a remote attacker to conduct cross-site scripting attacks. The vulnerability is a stored cross-site scripting (XSS) issue, which can be exploited by attackers with Item/Configure permission. The job names, report names, and index page titles are not escaped, leading to this vulnerability.

Recommendations For Jenkins HTML Publisher Plugin versions 1.32 and earlier, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the report frame and ensuring that only trusted users have Item/Configure permission.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02005

CVE-2024-28150

GHSA-XRRW-9J78-HPF3

Affected Products

Jenkins

Jenkins Html Publisher Plugin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-28150 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28150 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xrrw-9j78-hpf3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02005 · Security Note
• https://jenkins.io/security/advisory/2024-03-06/#SECURITY-3302 · Vendor Advisory
• https://github.com/jenkinsci/htmlpublisher-plugin · Note
• https://github.com/jenkinsci/htmlpublisher-plugin/commit/c0eed940e65ea90f9b5ba21aa3d953546d5cd8ad · Note
• https://cybersecurity-help.cz/vdb/SB2024030813 · Note
• https://t.me/cvenotify/73147 · Telegram Post
• https://t.me/cvenotify/121110 · Telegram Post
• https://t.me/cvenotify/73181 · Telegram Post
• http://openwall.com/lists/oss-security/2024/03/06/3 · Note