medium5.4
CVE-2020-2136
Improper Neutralization of Input During Web Page Generation in Jenkins Git Plugin
Impact
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:git | <= 4.2.0 | 4.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Git | through 4.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2020/03/09/1
- https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1723
- https://github.com/advisories/GHSA-6c7r-6p5m-cp82
- https://nvd.nist.gov/vuln/detail/CVE-2020-2136
- https://github.com/jenkinsci/git-plugin/commit/f581998be38cfed8e080c672c4b7caa8b4a45979