CVE-2023-40342: XSS
Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control JUnit report file contents.
Other sources
Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control JUnit report file contents.
Flaky Test Handler Plugin 1.2.3 escapes JUnit test contents when showing them on the Jenkins UI.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40342?
CVE-2023-40342 is a vulnerability in Jenkins Flaky Test Handler Plugin 1.2.2 and earlier versions that allows for stored cross-site scripting (XSS) attacks.
How does CVE-2023-40342 impact Jenkins?
CVE-2023-40342 allows attackers who can control JUnit report file contents to exploit a stored XSS vulnerability in Jenkins Flaky Test Handler Plugin, potentially compromising the security and integrity of the system.
What is the severity of CVE-2023-40342?
The severity of CVE-2023-40342 is rated as high, with a severity value of 8.
How can I fix CVE-2023-40342?
To fix CVE-2023-40342, upgrade to Flaky Test Handler Plugin version 1.2.3 or later, which includes the necessary fix to escape JUnit test contents and prevent XSS attacks.
Where can I find more information about CVE-2023-40342?
More information about CVE-2023-40342 can be found on the NIST National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2023-40342 and on the Jenkins security advisory page at https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3223.