medium6.1
CVE-2020-2140
XSS vulnerability in Jenkins Audit Trail Plugin
Impact
Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. Audit Trail Plugin 3.3 escapes the affected part of the error message.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:audit-trail | <= 3.2 | 3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Audit Trail | through 3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2020/03/09/1
- https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1722
- https://github.com/advisories/GHSA-cj2g-wwfv-mvjh
- https://nvd.nist.gov/vuln/detail/CVE-2020-2140
- https://github.com/jenkinsci/audit-trail-plugin/commit/40c6d621a03e6a50b291dca7188d07d0aa3de946