CVE-2023-33002

MediumCVSS 5.4

Published: 16/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.36%

82th percentile - higher than 82% of all known CVEs

Summary

The Jenkins TestComplete support Plugin version 2.8.1 and earlier does not escape the TestComplete project name, leading to a stored cross-site scripting (XSS) vulnerability. Attackers with Item/Configure permissions can exploit this flaw.

Risk Assessment

The organization may be exposed to XSS attacks, potentially leading to data theft or session hijacking. Exploitation of this vulnerability could threaten the integrity of the application and data.

Recommendation

It is recommended to update the plugin to the latest version that addresses this vulnerability. Additionally, permissions for Item/Configure should be restricted for users who do not require them.

Original NVD description (English source)

Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.