CVE-2024-28149: XSS
Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.
Other sources
SECURITY-784 / CVE-20218-1000175 is a path traversal vulnerability in HTML Publisher Plugin 1.15 and earlier. The fix for it retained compatibility for older reports as a fallback.
In HTML Publisher Plugin 1.16 through 1.32 (both inclusive) this fallback for reports created in HTML Publisher Plugin 1.15 and earlier does not properly sanitize input. This allows attackers with Item/Configure permission to do the following:
Implement stored cross-site scripting (XSS) attacks.
Determine whether a path on the Jenkins controller file system exists, without being able to access it.
HTML Publisher Plugin 1.32.1 removes support for reports created before HTML Publisher Plugin 1.15. Those reports are retained on disk, but may no longer be accessible through the Jenkins UI.
References:
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3301
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28149?
CVE-2024-28149 is considered to be a medium-severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
Who is affected by CVE-2024-28149?
CVE-2024-28149 affects users of Jenkins HTML Publisher Plugin versions 1.16 to 1.32, who have Item/Configure permission.
How do I fix CVE-2024-28149?
You can fix CVE-2024-28149 by upgrading the Jenkins HTML Publisher Plugin to version 1.32.1 or later.
What type of attacks can CVE-2024-28149 facilitate?
CVE-2024-28149 can facilitate cross-site scripting (XSS) attacks against users of the Jenkins environment.
Can attackers exploit CVE-2024-28149 remotely?
Yes, attackers with the appropriate permissions can exploit CVE-2024-28149 to perform actions remotely on affected Jenkins instances.