CVE-2023-25761
Medium
Description
Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Jenkins Junit
PublishedFeb 15, 2023
First seenFeb 15, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- org.jenkins-ci.plugins:junit1166.1168.vd6b_8042a_06de or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins junit | v ≤ 1166.va_436e268e972 | — |
| org.jenkins-ci.plugins:junitMaven | v < 1166.1168.vd6b_8042a_06de | 1166.1168.vd6b_8042a_06de |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.