CVE-2023-28669

Deeper analysis

Jenkins JaCoCo Plugin 3.3.2 and earlier contains a stored cross-site scripting vulnerability because it fails to escape class and method names rendered in the user interface. The affected component is the post-build action that records JaCoCo coverage reports within Jenkins.

Attackers who can supply or modify the input files processed by this action are able to inject malicious scripts that execute in the browsers of other users viewing the coverage results, achieving limited impact on confidentiality and integrity under the reported CVSS vector.

The Jenkins security advisory published on 2023-03-21 details the issue under SECURITY-3061 and provides the primary reference for mitigation steps, including any available plugin updates.

The associated EPSS score has remained near 0.09 with only a minor peak and does not indicate a significant post-disclosure increase in exploitation interest.