CVE-2023-25761: 
Java vulnerability analysis and mitigation

CVE-2023-25761 is a stored cross-site scripting (XSS) vulnerability discovered in the Jenkins JUnit Plugin, disclosed on February 15, 2023. The vulnerability affects JUnit Plugin versions up to and including 1166.va_436e268e972, where the plugin fails to properly escape test case class names in JavaScript expressions (Jenkins Advisory).

The vulnerability stems from the JUnit Plugin's failure to escape test case class names in JavaScript expressions. This security flaw has been rated as having a High severity CVSS score. The issue was fixed in JUnit Plugin version 1166.1168.vd6b_8042a_06de, which implements proper escaping of test case class names in JavaScript expressions (Jenkins Advisory).

The vulnerability allows attackers who can control test case class names in the JUnit resources processed by the plugin to execute stored cross-site scripting (XSS) attacks. This could potentially lead to unauthorized access and manipulation of Jenkins resources (Jenkins Advisory).

The vulnerability is exploitable by attackers who have the ability to control test case class names in the JUnit resources that are processed by the plugin. The stored XSS nature of the vulnerability means that the malicious payload persists in the system and can affect users who access the compromised resources (Jenkins Advisory).

The recommended mitigation is to update the JUnit Plugin to version 1166.1168.vd6b_8042a_06de or later, which includes the security fix that properly escapes test case class names in JavaScript expressions (Jenkins Advisory).