Vulnerability · Published May 16, 2023 · Assigned by jenkins

CVE-2023-32984

Medium 5.4

In plain English

A medium-severity cross-site scripting in Jenkins TestNG Results Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.5%top 60.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.jenkins-ci.plugins:testng-plugin	730.732.v959a	GHSA-h3hg-r97v-5r9w

Affected products (as reported)

Vendor	Product	Versions
Jenkins Project	Jenkins TestNG Results Plugin	0 – through 730.v4c5283037693

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Jenkins Security Advisory 2023-05-16 vendor-advisory