CVE-2023-33007

MediumCVSS 5.4

Published: 16/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

36th percentile - higher than 36% of all known CVEs

Summary

The Jenkins LoadComplete support Plugin version 1.0 and earlier does not escape the LoadComplete test name, leading to a stored XSS vulnerability.

Risk Assessment

Attackers with Item/Configure permissions can exploit this vulnerability to inject malicious code, potentially leading to data theft or session hijacking.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and review user permissions in the system.

Original NVD description (English source)

Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.