{"id":"CVE-2023-32984","aliases":["EUVD-2023-1550","GHSA-h3hg-r97v-5r9w"],"status":"published","title":"Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability","description":"Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00456,"percentile":0.39884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-05-16T16:00:05Z","modified":"2026-06-17T05:59:58Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:testng-plugin","fixed_in":["730.732.v959a"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:testng-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"730.732.v959a"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:testng-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"730.732.v959a"}]}],"versions":["0.16","0.17","0.18","0.19","0.20","0.21","0.22","0.23","0.24","0.25","0.26","0.27","0.28","0.29","0.30","0.31","0.32","0.33","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","1.9.1","552.va20eb2369116","554.va4a552116332","555.va0d5f66521e3","700.va_ea_5873a_3399","730.v4c5283037693"]}],"products":[{"vendor":"jenkins","product":"testng_results"},{"vendor":"jenkins project","product":"jenkins testng results plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3047","tags":["vendor-advisory","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32984","tags":["advisory"]},{"url":"https://github.com/jenkinsci/testng-plugin-plugin/commit/5f3d83ca56c0657fc09af7ea70cfbdd691adeaab","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h3hg-r97v-5r9w"}],"sources":{"cve":[{"id":"CVE-2023-32984","description":"Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.","status":"published","published":"2023-05-16T16:00:05.973Z","modified":"2025-01-23T20:36:38.661Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-1550","description":"Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.","status":"published","published":"2023-05-16T16:00:05Z","modified":"2025-01-23T20:36:38Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:14.026358Z"}],"ghsa":[{"id":"GHSA-h3hg-r97v-5r9w","title":"Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability","description":"Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin’s test information pages.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.\n\nTestNG Results Plugin 730.732.v959a_3a_a_eb_a_72 escapes the affected values that are parsed from TestNG report files.","status":"published","published":"2023-05-16T18:30:16Z","modified":"2024-01-05T13:20:05Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:29.411214Z"}],"nvd":[{"id":"CVE-2023-32984","description":"Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.","status":"published","published":"2023-05-16T16:15:11.033Z","modified":"2026-06-17T05:59:58.987Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:02.399327Z"}],"osv":[{"id":"GHSA-h3hg-r97v-5r9w","title":"Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability","description":"Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin’s test information pages.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.\n\nTestNG Results Plugin 730.732.v959a_3a_a_eb_a_72 escapes the affected values that are parsed from TestNG report files.","status":"published","published":"2023-05-16T18:30:16Z","modified":"2024-02-16T08:23:33.722015Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.546324Z"}]}}