Description
Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/02/15/4
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032
Related Vulnerabilities
CVE-2020-21122 Vulnerability in maven package com.bstek.ureport:ureport2-console
CVE-2020-8124 Vulnerability in maven package org.webjars.bowergithub.unshiftio:url-parse
CVE-2019-16942 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-10591 Vulnerability in maven package com.walmartlabs.concord.server:concord-server
CVE-2022-45064 Vulnerability in maven package org.apache.sling:org.apache.sling.engine