PT-2024-2110 · Jenkins · Jenkins Html Publisher Plugin+1

Kevin Guerroudj · Published 2024-03-06 · Updated 2025-05-06 · CVE-2024-28149

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins HTML Publisher Plugin versions 1.16 through 1.32

Description The issue arises from the plugin's failure to properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks. This can also enable attackers to determine whether a specific path exists on the Jenkins controller file system.

Recommendations For Jenkins HTML Publisher Plugin versions 1.16 through 1.32, update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02006

CVE-2024-28149

GHSA-8VCG-V7G4-3VR7

RHSA-2024:3634

RHSA-2024:3635

RHSA-2024:3636

RHSA-2024:4597

Affected Products

Jenkins

Jenkins Html Publisher Plugin

References · 14

• https://osv.dev/vulnerability/CVE-2024-28149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28149 · Security Note
• https://jenkins.io/security/advisory/2024-03-06/#SECURITY-3301 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02006 · Security Note
• https://osv.dev/vulnerability/GHSA-8vcg-v7g4-3vr7 · Vendor Advisory
• https://github.com/jenkinsci/htmlpublisher-plugin · Note
• https://github.com/jenkinsci/htmlpublisher-plugin/commit/8bf2e2297a86ad50f7567fb953b2f8ec18b2891b · Note
• https://t.me/cvenotify/73180 · Telegram Post
• https://t.me/cvenotify/73146 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024030813 · Note
• https://t.me/cvenotify/121109 · Telegram Post
• https://jenkins.io/security/advisory/2024-03-06/#SECURITY-3302 · Note
• https://security.snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIPLUGINS-6405822 · Note
• http://openwall.com/lists/oss-security/2024/03/06/3 · Note