CVE-2023-32984: Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability
Summary
CVE-2023-32984: Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability. Affects org.jenkins-ci.plugins:testng-plugin versions < 730.732.v959a. Fixed in 730.732.v959a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins TestNG Results Plugin is a Maven ecosystem package that provides functionality for parsing and displaying TestNG report files in Jenkins. It allows users to view detailed information about test results, including test suites, test cases, and their statuses. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins TestNG Results Plugin version 730.v4c5283037693 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin fails to properly escape certain values parsed from TestNG report files, which are then displayed on the plugin's test information pages. This allows an attacker to inject malicious scripts into the plugin's output, potentially leading to the execution of arbitrary code in the context of a user's browser. The vulnerability can be exploited by providing a crafted TestNG report file.
How To Fix
Latest published version: 981.v1dc64d227855 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
730.732.v959a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the TestNG Results Plugin or restrict access to the plugin's test information pages. This can be done by removing or disabling the plugin in the Jenkins configuration or by adjusting user permissions to limit access to the affected pages.
Conclusion
The Jenkins TestNG Results Plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be mitigated by upgrading to the latest version of the plugin. It is important to apply the fix to prevent potential exploitation and ensure the security of your Jenkins environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:testng-plugin →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized access, data theft, or further exploitation of the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fix to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity level.
While upgrading to the latest version of the TestNG Results Plugin is the recommended solution, you can temporarily mitigate the risk by disabling the plugin or restricting access to the affected pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:testng-plugin.
