CVE-2023-25761

Опубликовано: 15 фев. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Ссылки

http://www.openwall.com/lists/oss-security/2023/02/15/4
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032
Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/02/15/4
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:junit:*:*:*:*:*:jenkins:*:*

Версия до 1166.va_436e268e972 (включая)

EPSS

Процентиль: 81%

0.01511

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVE-2023-25761

CVSS3: 5.4

redhat

почти 3 года назад

CVE-2023-25761

CVSS3: 5.4

msrc

4 месяца назад

GHSA-ph74-8rgx-64c5

CVSS3: 5.4

github

почти 3 года назад

Cross-site Scripting in Jenkins JUnit Plugin

EPSS

Процентиль: 81%

0.01511

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79