CVE-2023-25761: 
Java vulnerability analysis and mitigation

CVE-2023-25761 is a stored cross-site scripting (XSS) vulnerability discovered in the Jenkins JUnit Plugin, disclosed on February 15, 2023. The vulnerability affects JUnit Plugin versions up to and including 1166.va_436e268e972, where the plugin fails to properly escape test case class names in JavaScript expressions (Jenkins Advisory).

The vulnerability stems from the JUnit Plugin's failure to escape test case class names in JavaScript expressions. This security flaw has been rated as having a High severity CVSS score. The issue was fixed in JUnit Plugin version 1166.1168.vd6b8042a06de, which implements proper escaping of test case class names in JavaScript expressions (Jenkins Advisory).

The vulnerability allows attackers who can control test case class names in the JUnit resources processed by the plugin to execute stored cross-site scripting (XSS) attacks. This could potentially lead to unauthorized access and manipulation of Jenkins resources (Jenkins Advisory).

The recommended mitigation is to update the JUnit Plugin to version 1166.1168.vd6b8042a06de or later, which includes the security fix that properly escapes test case class names in JavaScript expressions (Jenkins Advisory).