5.4 Medium

CVE-2023-33002 Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a…

Description

Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins TestComplete support Plugin 2.8	earliest → 2.8.1	No fix stated

The 3 CVEs of Jenkins TestComplete support Plugin →

CVE-2023-24443 Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity… 9.8 Critical CVE-2020-2209 Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the… Not rated

Do you use Jenkins TestComplete support Plugin?

Track this CVE Watch Jenkins TestComplete support Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2023-33002

Timeline

Published May 16, 2023
Last modified January 23, 2025

References

Jenkins Security Advisory 2023-05-16 www.jenkins.io

Track this CVE

CVE-2023-33002 Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a…

Description

Affected products and versions

Other CVEs of Jenkins TestComplete support Plugin