CVE-2023-25761: XSS
A flaw was found in the Jenkins JUnit plugin. The affected versions of the JUnit Plugin do not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability. This may allow an attacker to control test case class names in the JUnit resources processed by the plugin.
Other sources
Jenkins JUnit Plugin 1166.va436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.
JUnit Plugin 1166.va436e268e972 and earlier does not escape test case class names in JavaScript expressions. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-25761?
CVE-2023-25761 is a vulnerability in the Jenkins JUnit Plugin that allows for stored cross-site scripting (XSS) attacks.
What is the severity of CVE-2023-25761?
CVE-2023-25761 has a severity score of 5.4, which is considered medium.
How does CVE-2023-25761 affect Jenkins?
CVE-2023-25761 affects the JUnit Plugin in Jenkins and allows attackers to perform stored XSS attacks.
Is there a fix available for CVE-2023-25761?
Yes, the recommended fix for CVE-2023-25761 is to update the JUnit Plugin to version 4.12.1683009955-1.el8 or later.
Where can I find more information about CVE-2023-25761?
You can find more information about CVE-2023-25761 on the CVE website, the NVD website, and the Jenkins Security Advisory page.