5.4
Medium
CVE-2023-28678 Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on…
Description
Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Cppcheck Plugin 1.26 | earliest → 1.26 | No fix stated |