CVE-2024-28150: Jenkins HTML Publisher Plugin Stored XSS vulnerability
Summary
CVE-2024-28150: Jenkins HTML Publisher Plugin Stored XSS vulnerability. Affects org.jenkins-ci.plugins:htmlpublisher versions < 1.32.1. Fixed in 1.32.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins HTML Publisher Plugin is a Maven package that provides functionality for publishing HTML reports as part of Jenkins job builds. It allows users to generate and display HTML reports within the Jenkins interface. This plugin is commonly used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins HTML Publisher Plugin version 1.32 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises due to the plugin's failure to properly escape job names, report names, and index page titles displayed as part of the report frame. Attackers with Item/Configure permission can exploit this vulnerability to inject malicious scripts into the HTML reports, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
1.32.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the HTML Publisher Plugin until the vulnerability is patched. This can be done by navigating to the Manage Plugins section in Jenkins, finding the HTML Publisher Plugin, and disabling it. However, this workaround will prevent the generation and display of HTML reports until the plugin is re-enabled or updated.
Conclusion
The Jenkins HTML Publisher Plugin version 1.32 and earlier is vulnerable to a stored XSS attack. It is crucial to update the plugin to version 1.32.1 or later to mitigate this vulnerability. Users can also temporarily disable the plugin until the update is applied. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:htmlpublisher →
FAQ
This vulnerability allows attackers with Item/Configure permission to inject malicious scripts into HTML reports, potentially leading to unauthorized access, data theft, or other malicious activities.
Users of Jenkins HTML Publisher Plugin versions 1.32 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fixes to prevent potential exploitation.
No, this vulnerability requires attackers to have Item/Configure permission in Jenkins to exploit it.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:htmlpublisher.
