Jenkins Flaky Test Handler Plugin stored cross-site scripting vulnerability
High severity
GitHub Reviewed
Published
Aug 16, 2023
to the GitHub Advisory Database
•
Updated Nov 11, 2023
Package
Affected versions
< 1.2.3
Patched versions
1.2.3
Description
Published by the National Vulnerability Database
Aug 16, 2023
Published to the GitHub Advisory Database
Aug 16, 2023
Reviewed
Aug 16, 2023
Last updated
Nov 11, 2023
Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control JUnit report file contents.
Flaky Test Handler Plugin 1.2.3 escapes JUnit test contents when showing them on the Jenkins UI.
References