Every CVE Search/ Get API key

CVE-2023-25761

Cross-site Scripting in Jenkins JUnit Plugin

5.4 MediumFix available

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.70%Down 0.2 points since Feb 16, 2023
90%50%10%1%

What each source reports

NVD Score used 5.4

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Record
CVE-2023-25761
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List 5.4

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Record
CVE-2023-25761
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2023-0762 5.4

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Record
EUVD-2023-0762
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-ph74-8rgx-64c5 5.4

Cross-site Scripting in Jenkins JUnit Plugin

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Record
GHSA-ph74-8rgx-64c5
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Record
CVE-2023-25761
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-ph74-8rgx-64c5 5.4

Cross-site Scripting in Jenkins JUnit Plugin

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Record
GHSA-ph74-8rgx-64c5
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
Show 12 moreShow less
OSVRHSA-2023:1866 5.4

Red Hat Security Advisory: OpenShift Container Platform 4.10.58 security update

Record
RHSA-2023:1866
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2023:3195 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2023:3195
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:3198 9.9

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2023:3198
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:3299 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2023:3299
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:6171 9.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.11 Openshift Jenkins security update

Record
RHSA-2023:6171
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:6172 9.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update

Record
RHSA-2023:6172
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:6179 9.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update

Record
RHSA-2023:6179
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:7288 9.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update

Record
RHSA-2023:7288
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:0775 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2024:0775
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:0776 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2024:0776
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:0777 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2024:0777
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:0778 9.8

Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update

Record
RHSA-2024:0778
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:junit
Maven
 through 1166.va
1166.1168.vd6b_8042a_06de
org.jenkins-ci.plugins:junit
Maven
 before 1166.1168.vd6b_8042a_06de, plus listed versions
1.01.11.101.111.12
Show 45 moreShow less
1.131.141.151.181.191.21.2-beta-11.2-beta-21.2-beta-31.2-beta-41.201.211.221.22-beta-11.22.11.22.21.231.241.251.261.26.11.271.281.291.31.301.311.321.331.341.351.361.371.381.391.41.411.421.431.441.451.461.471.481.49
1166.1168.vd6b_8042a_06de
jenkins-2-plugins
Red Hat:openshift:4.10::el8
From an advisory covering 2 CVEs
 before 0:4.10.1681719745-1.el8
0:4.10.1681719745-1.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 6 CVEs
 before 0:4.12.1683009955-1.el8
0:4.12.1683009955-1.el8
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 6 CVEs
 before 0:2.387.1.1683009767-3.el8
0:2.387.1.1683009767-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 22 CVEs
 before 0:4.11.1683009941-1.el8
0:4.11.1683009941-1.el8
jenkins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 22 CVEs
 before 0:2.387.1.1683009763-3.el8
0:2.387.1.1683009763-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 16 CVEs
 before 0:4.13.1684911916-1.el8
0:4.13.1684911916-1.el8
jenkins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 16 CVEs
 before 0:2.387.3.1684911776-3.el8
0:2.387.3.1684911776-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 9 CVEs
 before 0:4.11.1698299029-1.el8
0:4.11.1698299029-1.el8
Show 15 moreShow less
Affected packages
PackageAffectedFixed
jenkins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 9 CVEs
 before 0:2.414.3.1698298955-3.el8
0:2.414.3.1698298955-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 10 CVEs
 before 0:4.12.1698294000-1.el8
0:4.12.1698294000-1.el8
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 10 CVEs
 before 0:2.414.3.1698293911-3.el8
0:2.414.3.1698293911-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 8 CVEs
 before 0:4.13.1698292274-1.el8
0:4.13.1698292274-1.el8
jenkins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 8 CVEs
 before 0:2.414.3.1698292201-3.el8
0:2.414.3.1698292201-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 8 CVEs
 before 0:4.14.1699356715-1.el8
0:4.14.1699356715-1.el8
jenkins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 8 CVEs
 before 0:2.414.3.1699356615-3.el8
0:2.414.3.1699356615-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 11 CVEs
 before 0:4.11.1706516946-1.el8
0:4.11.1706516946-1.el8
jenkins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 11 CVEs
 before 0:2.426.3.1706516929-3.el8
0:2.426.3.1706516929-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 10 CVEs
 before 0:4.13.1706516346-1.el8
0:4.13.1706516346-1.el8
jenkins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 10 CVEs
 before 0:2.426.3.1706516254-3.el8
0:2.426.3.1706516254-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 17 CVEs
 before 0:4.14.1706516441-1.el8
0:4.14.1706516441-1.el8
jenkins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 17 CVEs
 before 0:2.426.3.1706516352-3.el8
0:2.426.3.1706516352-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 24 CVEs
 before 0:4.12.1706515741-1.el8
0:4.12.1706515741-1.el8
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 24 CVEs
 before 0:2.426.3.1706515686-3.el8
0:2.426.3.1706515686-3.el8

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-25761 is a medium vulnerability (CVSS 5.4) in Jenkins Junit, published February 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in org.jenkins-ci.plugins:junit 1166.1168.vd6b_8042a_06de.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 36 versions and 136 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open