GHSA-xrrw-9j78-hpf3

Source

https://github.com/advisories/GHSA-xrrw-9j78-hpf3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-xrrw-9j78-hpf3/GHSA-xrrw-9j78-hpf3.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-xrrw-9j78-hpf3

Aliases

CVE-2024-28150

Published

2024-03-06T18:30:38Z

Modified

2024-11-22T22:31:44.730693Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins HTML Publisher Plugin Stored XSS vulnerability

Details

Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Database specific

{
    "github_reviewed_at": "2024-03-06T19:08:40Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2024-03-06T17:15:10Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:htmlpublisher

Package

Name: org.jenkins-ci.plugins:htmlpublisher; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/htmlpublisher

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.32.1

Affected versions

0.*

0.7

0.8

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.16.1

1.17

1.18

1.19

1.20

1.21

1.22-beta-1

1.22

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.30

1.31

1.32