{"id":"CVE-2022-45380","aliases":["GHSA-298r-5c48-7q2r"],"url":"https://o3.security/vulnerability/CVE-2022-45380","summary":"Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion","details":"JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links.\n\nThis is done in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.\n\nJUnit Plugin 1160.vf1f01a_a_ea_b_7f no longer converts URLs to clickable links.","published":"2022-11-15T20:15:11.480Z","modified":"2026-10-24T14:35:08.019865547Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:junit","fixedVersion":"1160.vf1f01a_a_ea_b_7f"}],"fix":{"url":"https://github.com/jenkinsci/junit-plugin/commit/f1f01aaeab7fa35017112f6163b89283390f5da8","label":"jenkinsci/junit-plugin@f1f01aa"},"references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2888"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2022/11/15/4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45380"},{"type":"WEB","url":"https://github.com/jenkinsci/junit-plugin/commit/f1f01aaeab7fa35017112f6163b89283390f5da8"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/junit-plugin"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T14:35:08.019865547Z"}}