CVE-2023-28669

—

CVSS 3.1

5.4 medium

EPSS

<1%p45

Published

Apr 2, 2023 (Apr 2, 2023)

Modified

Jun 17, 2026

Description

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action.

Vendors: jenkins
Products: jacoco
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.