CVE-2024-28150: 
Java vulnerability analysis and mitigation

CVE-2024-28150 is a stored cross-site scripting (XSS) vulnerability affecting Jenkins HTML Publisher Plugin versions 1.32 and earlier. The vulnerability was discovered and reported by Kevin Guerroudj from CloudBees, Inc., and was publicly disclosed on March 6, 2024. The vulnerability affects the HTML Publisher Plugin's handling of job names, report names, and index page titles shown in the report frame (Jenkins Advisory).

The vulnerability stems from the HTML Publisher Plugin's failure to properly escape job names, report names, and index page titles when they are displayed as part of the report frame. This security flaw is classified as a stored cross-site scripting (XSS) vulnerability with a High severity rating. The vulnerability can be exploited by attackers who have Item/Configure permission in the Jenkins environment (Jenkins Advisory).

The vulnerability allows attackers with Item/Configure permission to execute stored cross-site scripting (XSS) attacks through maliciously crafted job names, report names, and index page titles. This could potentially lead to unauthorized access to sensitive information, session hijacking, or other malicious actions within the context of the Jenkins application (Jenkins Advisory).

The vulnerability requires the attacker to have Item/Configure permission in the Jenkins environment. This prerequisite somewhat limits the potential attack surface, as it requires a certain level of access privileges to exploit (Jenkins Advisory).

The vulnerability has been fixed in HTML Publisher Plugin version 1.32.1. The fix includes two main components: escaping job names, report names, and index page titles when creating new reports, and implementing checks for unsafe characters in reports created in earlier releases. If unsafe characters are identified in older reports, the plugin refuses to show these frames. Users are advised to upgrade to version 1.32.1 to address this security issue (Jenkins Advisory).