medium5.4
CVE-2020-2193
Stored XSS vulnerability in Jenkins ECharts API Plugin
Impact
ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts. This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Job/Configure permission. ECharts API Plugin 4.7.0-4 escapes the parser identifier.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:echarts-api | < 4.7.0-4 | 4.7.0-4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Echarts Api | through 4.7.0-3 |