CVE-2023-33002: TestComplete support Plugin vulnerable to stored Cross-site Scripting
Summary
CVE-2023-33002: TestComplete support Plugin vulnerable to stored Cross-site Scripting. Affects org.jenkins-ci.plugins:TestComplete versions < 2.8.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TestComplete support Plugin is a Maven package that provides support for TestComplete projects in Jenkins. It allows users to integrate TestComplete tests into their Jenkins pipelines and view the test results. The plugin version 2.8.1 and earlier are affected by a stored cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The TestComplete support Plugin does not properly escape the TestComplete project name in its test result page. This allows attackers with Item/Configure permission to inject malicious scripts into the page, leading to a stored cross-site scripting vulnerability. The vulnerability has a CVSS score of 8.0, indicating a high severity. Exploiting this vulnerability can result in unauthorized access, data theft, and potential compromise of the Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have Item/Configure permission in Jenkins. Additionally, it is recommended to regularly monitor the Jenkins environment for any suspicious activities.
Conclusion
The TestComplete support Plugin version 2.8.1 and earlier is vulnerable to a stored cross-site scripting (XSS) vulnerability. As of now, there is no fix available, and users are advised to monitor the official GitHub repository for updates. It is recommended to take necessary precautions, such as limiting Item/Configure permission and regularly monitoring the Jenkins environment for any suspicious activities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:TestComplete →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the context of the TestComplete support Plugin, potentially leading to unauthorized access, data theft, and compromise of the Jenkins environment.
Users who have installed TestComplete support Plugin version 2.8.1 and earlier in their Jenkins environment are affected by this vulnerability.
As of now, there is no fix available. It is recommended to monitor the official GitHub repository for updates and apply the fix once it is released.
While there is no specific workaround mentioned, users can mitigate the risk by ensuring that only trusted users have Item/Configure permission in Jenkins and regularly monitoring the environment for any suspicious activities.
Yes, disabling the TestComplete support Plugin until a patch is available can help mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:TestComplete.
