CVE-2024-28150 json
Jenkins HTML Publisher Plugin Stored XSS vulnerability
published 2024-03-06 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-1047 , GHSA-xrrw-9j78-hpf3
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Patch / fix
- maven org.jenkins-ci.plugins:htmlpublisher 1.32.1
- jenkins html_publisher 1.32.1
- org.jenkins-ci.plugins htmlpublisher 1.32.1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-28150 updated cvss 8.0
jenkins-2-plugins: Stored XSS vulnerability in HTML Publisher Plugin
-
Red Hat OpenShift Developer Tools and Services jenkins-2-pluginsaffected: no fix available
-
Red Hat OpenShift Container Platform 3.11 jenkins-2-pluginsaffected: no fix planned “Out of support scope”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:htmlpublisher | <1.32.1 |
1.32.1 |
Affected products
- Jenkins Project Jenkins HTML Publisher Plugin
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/jenkinsci/htmlpublisher-plugin/commit/c0eed940e65ea90f9b5ba21aa3d953546d5cd8ad
web
-
jenkins.io
/security/advisory/2024-03-06/#SECURITY-3302
vendor-advisory, web
-
openwall.com
/lists/oss-security/2024/03/06/3
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2024-28150
advisory
-
github.com
/jenkinsci/htmlpublisher-plugin
package
Sources
- CVE List CVE-2024-28150
- GitHub Advisory GHSA-xrrw-9j78-hpf3
- NVD CVE-2024-28150
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.