A stored cross-site scripting vulnerability in the Jenkins HTML Publisher Plugin allows authenticated attackers to execute malicious scripts within the context of the Jenkins web interface.

This vulnerability is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input within the legacy wrapper file. It requires an attacker to possess Item/Configure permissions to trigger the payload.

Successful exploitation of this XSS vulnerability could allow an attacker to perform actions on behalf of other users, including administrators, leading to unauthorized configuration changes or sensitive data exposure. With a CVSS score of 8.0, the potential for high impact on integrity and confidentiality necessitates prompt remediation to prevent compromise of the CI/CD pipeline.

Immediate Action: Update the Jenkins HTML Publisher Plugin to version 427.1 or later to resolve the input validation flaw.

Proactive Monitoring: Review Jenkins audit logs for unusual configuration changes or unauthorized script executions associated with the HTML Publisher component.

Compensating Controls: Restrict Item/Configure permissions to a minimal set of trusted users to reduce the attack surface until the update is deployed.

Public Exploit Available: Unknown

Given the high severity of this vulnerability and the potential for unauthorized code execution within the Jenkins environment, administrators should prioritize updating the HTML Publisher Plugin to version 427.1 immediately. Limiting administrative privileges until the patch is verified remains a critical secondary control to mitigate risk in complex CI/CD environments.