Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-45380 · ADVISORY
• jenkinsci/junit-plugin commit f1f01aa · WEB
• jenkinsci/junit-plugin · PACKAGE
• jenkins.io/security/advisory/2022-11-15 · WEB
• openwall.com/lists/oss-security/2022/11/15/4 · WEB

org.jenkins-ci.plugins:junit のその他の脆弱性

• CVE-2023-25761中 5.4Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored …
• CVE-2022-34176中 5.4Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site script…
• CVE-2018-1000411中 6.5A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the descri…
• CVE-2018-1000056高 8.3Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers wi…