CVE-2022-45380
Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion
Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Record
CVE-2022-45380- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Record
CVE-2022-45380- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-7196
Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Record
EUVD-2022-7196- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-298r-5c48-7q2r
Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion
JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links.
This is done in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
JUnit Plugin 1160.vf1f01a_a_ea_b_7f no longer converts URLs to clickable links.
- Record
GHSA-298r-5c48-7q2r- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Record
CVE-2022-45380- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-298r-5c48-7q2r
Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion
JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links.
This is done in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
JUnit Plugin 1160.vf1f01a_a_ea_b_7f no longer converts URLs to clickable links.
- Record
GHSA-298r-5c48-7q2r- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRHSA-2023:0560
Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update
- Record
RHSA-2023:0560- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:0777
Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update
- Record
RHSA-2023:0777- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:junitMaven |
through 1159.v0b | 1160.vf1f01a_a_ea_b_7f |
org.jenkins-ci.plugins:junitMaven |
before 1160.vf1f01a_a_ea_b_7f, plus listed versions 1.01.11.101.111.12 Show 45 moreShow less1.131.141.151.181.191.21.2-beta-11.2-beta-21.2-beta-31.2-beta-41.201.211.221.22-beta-11.22.11.22.21.231.241.251.261.26.11.271.281.291.31.301.311.321.331.341.351.361.371.381.391.41.411.421.431.441.451.461.471.481.49 |
1160.vf1f01a_a_ea_b_7f |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 From an advisory covering 23 CVEs |
before 0:4.10.1675144701-1.el8 | 0:4.10.1675144701-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.9::el8 From an advisory covering 26 CVEs |
before 0:4.9.1675668922-1.el8 | 0:4.9.1675668922-1.el8 |
jenkinsRed Hat:openshift:4.9::el8 From an advisory covering 26 CVEs |
before 0:2.361.1.1675668150-1.el8 | 0:2.361.1.1675668150-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-45380 is a medium vulnerability (CVSS 5.4) in Jenkins Junit, published November 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in org.jenkins-ci.plugins:junit 1160.vf1f01a_a_ea_b_7f.
References
jenkins.io/security/advisory/2022-11-15
openwall.com/lists/oss-security/2022/11/15/4
nvd.nist.gov/vuln/detail/CVE-2022-45380
github.com/jenkinsci/junit-plugin/commit/f1f01aaeab7fa35017112f6163b89283390f5da8
Show 117 moreShow less
access.redhat.com/errata/RHSA-2023:0560
bugzilla.redhat.com/show_bug.cgi?id=1856376
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0560.json
cve.org/CVERecord?id=CVE-2020-7692
bitbucket.org/snakeyaml/snakeyaml/issues/525
mail-archive.com/[email protected]/msg39312.html
docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html
Left out here: 34 versions. The JSON record has them.