{"id":"CVE-2022-34778","aliases":["EUVD-2022-6292","GHSA-8hv7-4vfc-w8pg"],"status":"published","title":"Cross-site Scripting in Jenkins TestNG Results Plugin","description":"Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00615,"percentile":0.49756,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-06-30T17:45:59Z","modified":"2026-06-17T04:50:54Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:testng-plugin","fixed_in":["555.va0d5f66521e3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:testng-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"554.va4a552116332"},{"fixed":"555.va0d5f66521e3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:testng-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"555.va0d5f66521e3"}]}],"versions":["0.16","0.17","0.18","0.19","0.20","0.21","0.22","0.23","0.24","0.25","0.26","0.27","0.28","0.29","0.30","0.31","0.32","0.33","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","1.9.1","552.va20eb2369116","554.va4a552116332"]}],"products":[{"vendor":"jenkins","product":"testng_results"},{"vendor":"jenkins project","product":"jenkins testng results plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2788","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34778","tags":["advisory"]},{"url":"https://github.com/jenkinsci/testng-plugin-plugin/commit/a0d5f66521e3bc470047a0b683004ce8889d3369","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8hv7-4vfc-w8pg"},{"url":"https://github.com/jenkinsci/testng-plugin-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-34778","description":"Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.","status":"published","published":"2022-06-30T17:45:59Z","modified":"2024-11-20T15:46:21.953Z","updated_at":"2026-11-02T14:34:42.028422Z"}],"euvd":[{"id":"EUVD-2022-6292","description":"Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.","status":"published","published":"2022-06-30T17:45:59Z","modified":"2024-11-20T15:46:21Z","updated_at":"2026-11-03T00:04:54.7374Z"}],"ghsa":[{"id":"GHSA-8hv7-4vfc-w8pg","title":"Cross-site Scripting in Jenkins TestNG Results Plugin","description":"TestNG Results Plugin has options in its post-build step configuration to not escape test descriptions and exception messages. If those options are unchecked, TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped text provided in test results. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results. TestNG Results Plugin 555.va0d5f66521e3 by default ignores the user-level options to not escape content. Administrators who want to restore this functionality must set the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.plugins.testng.Publisher.allowUnescapedHTML` to true.","status":"published","published":"2022-07-01T00:01:07Z","modified":"2023-02-02T05:02:53Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:40.500292Z"}],"nvd":[{"id":"CVE-2022-34778","description":"Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.","status":"published","published":"2022-06-30T18:15:09.747Z","modified":"2026-06-17T04:50:54.617Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:22.966735Z"}],"osv":[{"id":"GHSA-8hv7-4vfc-w8pg","title":"Cross-site Scripting in Jenkins TestNG Results Plugin","description":"TestNG Results Plugin has options in its post-build step configuration to not escape test descriptions and exception messages. If those options are unchecked, TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped text provided in test results. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results. TestNG Results Plugin 555.va0d5f66521e3 by default ignores the user-level options to not escape content. Administrators who want to restore this functionality must set the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.plugins.testng.Publisher.allowUnescapedHTML` to true.","status":"published","published":"2022-07-01T00:01:07Z","modified":"2023-11-08T04:09:46.448429Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}