GHSA-8hv7-4vfc-w8pg

Suggest an improvement
Source
https://github.com/advisories/GHSA-8hv7-4vfc-w8pg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-8hv7-4vfc-w8pg/GHSA-8hv7-4vfc-w8pg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8hv7-4vfc-w8pg
Aliases
  • CVE-2022-34778
Published
2022-07-01T00:01:07Z
Modified
2023-11-08T04:09:46.448429Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Cross-site Scripting in Jenkins TestNG Results Plugin
Details

TestNG Results Plugin has options in its post-build step configuration to not escape test descriptions and exception messages. If those options are unchecked, TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped text provided in test results. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results. TestNG Results Plugin 555.va0d5f66521e3 by default ignores the user-level options to not escape content. Administrators who want to restore this functionality must set the Java system property hudson.plugins.testng.Publisher.allowUnescapedHTML to true.

Database specific 
{
    "nvd_published_at": "2022-06-30T18:15:00Z",
    "github_reviewed_at": "2022-07-13T15:45:02Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Maven / org.jenkins-ci.plugins:testng-plugin

Package

Name
org.jenkins-ci.plugins:testng-plugin
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/testng-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
555.va0d5f66521e3

Affected versions

0.*

0.16
0.17
0.18
0.19
0.20
0.21
0.22
0.23
0.24
0.25
0.26
0.27
0.28
0.29
0.30
0.31
0.32
0.33

1.*

1.0
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.9.1
1.10
1.11
1.12
1.13
1.14
1.15

552.*

552.va20eb2369116

554.*

554.va4a552116332

Database specific 

{
    "last_known_affected_version_range": "<= 554.va4a552116332"
}