Jenkins HTML Publisher Plugin does not properly sanitize input

2024-03-0618:30:38

Google

osv.dev

jenkins

html publisher

input sanitation

vulnerability

xss

file system.

5.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

CPENameOperatorVersion
org.jenkins-ci.plugins:htmlpublishereq1.28
org.jenkins-ci.plugins:htmlpublishereq1.27
org.jenkins-ci.plugins:htmlpublishereq1.26
org.jenkins-ci.plugins:htmlpublishereq1.24
org.jenkins-ci.plugins:htmlpublishereq1.16
org.jenkins-ci.plugins:htmlpublishereq1.16.1
org.jenkins-ci.plugins:htmlpublishereq1.22-beta-1
org.jenkins-ci.plugins:htmlpublishereq1.23
org.jenkins-ci.plugins:htmlpublishereq1.19
org.jenkins-ci.plugins:htmlpublishereq1.25

Name	Operator	Version
org.jenkins-ci.plugins:htmlpublisher	eq	1.28
org.jenkins-ci.plugins:htmlpublisher	eq	1.27
org.jenkins-ci.plugins:htmlpublisher	eq	1.26
org.jenkins-ci.plugins:htmlpublisher	eq	1.24
org.jenkins-ci.plugins:htmlpublisher	eq	1.16
org.jenkins-ci.plugins:htmlpublisher	eq	1.16.1
org.jenkins-ci.plugins:htmlpublisher	eq	1.22-beta-1
org.jenkins-ci.plugins:htmlpublisher	eq	1.23
org.jenkins-ci.plugins:htmlpublisher	eq	1.19
org.jenkins-ci.plugins:htmlpublisher	eq	1.25