Jenkins Testcomplete Support vulnerabilities

3 CVEs affecting Jenkins Testcomplete Support, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-33002, published 2023-05-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-33002, published 2023-05-16. Medium severity, CVSS 5.4. EPSS: 2.4% chance of exploitation in the next 30 days. Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with…
CVE-2023-24443, published 2023-01-26. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2209, published 2020-07-02. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or…