CVE-2024-28149 Jenkins HTML Publisher Plugin does not properly sanitize input

Medium 6.5 Published 6 Mar 2024 Updated 13 Feb 2025

Attackers with configure permissions can execute XSS and detect file paths in Jenkins HTML Publisher Plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-28149?

CVE-2024-28149 is a medium-severity cross-site scripting vulnerability in Jenkins HTML Publisher Plugin, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

Weakness: CWE-79

Which versions are affected by CVE-2024-28149?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:htmlpublisher. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:htmlpublisher` Maven	From `1.16`	`1.32.1`
`org.jenkins-ci.plugins:htmlpublisher` Maven	From `1.16`	`1.32.1`

Products include Jenkins Html Publisher.

How do I fix CVE-2024-28149?

Upgrade org.jenkins-ci.plugins:htmlpublisher to 1.32.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-28149 being exploited?

There is no known exploitation of CVE-2024-28149 in the wild and no public exploit code.

Sources

Also known as GHSA-8vcg-v7g4-3vr7.