Medium severity5.4NVD Advisory· Published May 16, 2023· Updated Jun 17, 2026

CVE-2023-32984

Description

Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:testng-pluginMaven	< 730.732.v959a	730.732.v959a

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/testng-plugin
Range: < 730.732.v959a
Jenkins Project/Jenkins Test Results Aggregator Plugincpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-h3hg-r97v-5r9wghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-32984ghsaADVISORY
www.jenkins.io/security/advisory/2023-05-16/nvdVendor AdvisoryWEB
github.com/jenkinsci/testng-plugin-plugin/commit/5f3d83ca56c0657fc09af7ea70cfbdd691adeaabghsaWEB

News mentions

Jenkins Security Advisory 2023-05-16
Jenkins Security Advisories · May 16, 2023

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000