TI-2022-15585 Aliases CVE-2022-34778 GHSA-8hv7-4vfc-w8pg

Cross-site scripting in Jenkins TestNG Results Plugin

LOW 25CWE-79Published 2022-06-30 · Updated 2024-11-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00615 49th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:testng-plugin (Maven): 555.va0d5f66521e3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins TestNG Results Plugin	up to 554.va4a552116332	—	No fix listed	CNA
—	org.jenkins-ci.plugins:testng-plugin (Maven)	before 555.va0d5f66521e3	555.va0d5f66521e3	Patch available	GHSA-8hv7-4vfc-w8pg

Jenkins TestNG Results Plugin VendorJenkins Affected up to 554.va4a552116332 Fixed in — No fix listed CNA
org.jenkins-ci.plugins:testng-plugin (Maven) Vendor— Affected before 555.va0d5f66521e3 Fixed in 555.va0d5f66521e3 Patch available GHSA-8hv7-4vfc-w8pg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:testng_results::::::jenkins::*	up to 554.va4a552116332	Vulnerable	Jenkins

cpe:2.3:a:jenkins:testng_results:*:*:*:*:*:jenkins:*:* Versions up to 554.va4a552116332 Vulnerable ·Jenkins

Remediation

Fix · GHSA-8hv7-4vfc-w8pg org.jenkins-ci.plugins:testng-plugin (Maven) Fixed in 555.va0d5f66521e3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-34778
2026-10-03 Alias added: GHSA-8hv7-4vfc-w8pg

References

Advisory 2

Other 2

TI-2023-16172 Cross-site scripting in Jenkins TestNG Results Plugin CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences