Every CVE Search/ Get API key

CVE-2024-28149

Jenkins HTML Publisher Plugin does not properly sanitize input

6.5 MediumFix available

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.70%Up 0.7 points since Mar 7, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.5

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

Record
CVE-2024-28149
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-0881 6.5

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

Record
EUVD-2024-0881
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-8vcg-v7g4-3vr7 8.0

Jenkins HTML Publisher Plugin does not properly sanitize input

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

Record
GHSA-8vcg-v7g4-3vr7
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
NVD 6.5

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

Record
CVE-2024-28149
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-79
Updated
2026-11-02
OSV 6.5

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

Record
CVE-2024-28149
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVGHSA-8vcg-v7g4-3vr7 8.0

Jenkins HTML Publisher Plugin does not properly sanitize input

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

Record
GHSA-8vcg-v7g4-3vr7
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2024:3634 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update

Record
RHSA-2024:3634
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:3635 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update

Record
RHSA-2024:3635
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:3636 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update

Record
RHSA-2024:3636
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:4597 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update

Record
RHSA-2024:4597
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:htmlpublisher
Maven
 1.16 up to 1.32.1
1.32.1
org.jenkins-ci.plugins:htmlpublisher
Maven
 1.16 up to 1.32.1, plus listed versions
1.16.11.171.181.191.20
Show 13 moreShow less
1.211.221.22-beta-11.231.241.251.261.271.281.291.301.311.32
1.32.1
jenkins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 8 CVEs
 before 0:2.440.3.1716387933-3.el8
0:2.440.3.1716387933-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 8 CVEs
 before 0:4.14.1716388016-1.el8
0:4.14.1716388016-1.el8
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 8 CVEs
 before 0:2.440.3.1716445200-3.el8
0:2.440.3.1716445200-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 8 CVEs
 before 0:4.12.1716445211-1.el8
0:4.12.1716445211-1.el8
jenkins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 8 CVEs
 before 0:2.440.3.1716445150-3.el8
0:2.440.3.1716445150-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 8 CVEs
 before 0:4.13.1716445207-1.el8
0:4.13.1716445207-1.el8
jenkins
Red Hat:ocp_tools:4.15::el8
From an advisory covering 9 CVEs
 before 0:2.440.3.1718879390-3.el8
0:2.440.3.1718879390-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.15::el8
From an advisory covering 9 CVEs
 before 0:4.15.1718879538-1.el8
0:4.15.1718879538-1.el8

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-28149 is a medium vulnerability (CVSS 6.5) in Jenkins Html Publisher, published March 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in org.jenkins-ci.plugins:htmlpublisher 1.32.1.

References

Show 57 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open