Vulnerability GHSA-f6vx-3fq6-hxm8
Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 years ago
May 24, 2022 at 05:13 PM UTC
Stored XSS vulnerability in Jenkins FitNesse Plugin
1.5.0 - 1.16.0 and 1.24.0 and 1.26.0 - 1.28.0 and 1.30.0 - 1.31.0
1.5.0 - 1.16.0 and 1.24.0 and 1.26.0 - 1.28.0 and 1.30.0 - 1.31.0
Summary
Stored XSS vulnerability in Jenkins FitNesse Plugin
Details
Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the XML input files processed by the plugin.
Jenkins FitNesse Plugin 1.32 escapes content from XML input files before rendering it on the Jenkins UI.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Jenkins FitNesse Plugin stores passwords unencrypted
1.5.0 - 1.16.0 and 1.24.0 and 1.26.0 - 1.28.0 and 1.30.0 - 1.31.0 and 1.33.0 - 1.36.0 GHSA-j4ph-wp3c-c37w
1.5.0 - 1.16.0 and 1.24.0 and 1.26.0 - 1.28.0 and 1.30.0 - 1.31.0 and 1.33.0 - 1.36.0 GHSA-j4ph-wp3c-c37w
High Risk
4 years ago
XXE vulnerability in FitNesse Plugin
1.5.0 - 1.16.0 and 1.24.0 and 1.26.0 - 1.28.0 and 1.30.0 GHSA-c3cg-mv5w-cvw8
1.5.0 - 1.16.0 and 1.24.0 and 1.26.0 - 1.28.0 and 1.30.0 GHSA-c3cg-mv5w-cvw8
Impacted packages
Timeline
Published
4 years ago
May 24, 2022 at 05:13 PM UTC
Last Modified
2 years ago
February 16, 2024 at 08:08 AM UTC