{"id":"CVE-2022-45380","aliases":["GHSA-298r-5c48-7q2r"],"url":"https://o3.security/vulnerability/CVE-2022-45380","summary":"Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion","details":"Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.","published":"2022-11-15T20:15:11.480Z","modified":"2026-07-09T05:17:53.485333Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:junit","fixedVersion":"1160.vf1f01a_a_ea_b_7f"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2888"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2022/11/15/4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T05:17:53.485333Z"}}