medium5.4
CVE-2020-2190
Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin
Impact
Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:script-security | <= 1.72 | 1.73 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Script Security | through 1.72 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2020/06/03/3
- https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1866
- https://github.com/advisories/GHSA-q87g-7mp5-765q
- https://nvd.nist.gov/vuln/detail/CVE-2020-2190
- https://github.com/jenkinsci/script-security-plugin/commit/99e6ac0df5fe0f0cc6c2a695f7c1f845279bedbd