Description
Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control JUnit report file contents.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/08/16/3
https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3223
Related Vulnerabilities
CVE-2019-0192 Vulnerability in maven package org.apache.solr:solr-core
CVE-2020-4059 Vulnerability in npm package mversion
CVE-2020-7743 Vulnerability in npm package mathjs
CVE-2021-23372 Vulnerability in npm package mongo-express
CVE-2023-22946 Vulnerability in maven package org.apache.spark:spark-core_2.12