high8.0
CVE-2020-2238
Stored XSS vulnerability in Jenkins Git Parameter Plugin
Impact
Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Git Parameter Plugin 0.9.13 escapes the repository field on the 'Build with Parameters' page.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.tools:git-parameter | <= 0.9.12 | 0.9.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Git Parameter | through 0.9.12 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2020/09/01/3
- https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1884
- https://github.com/advisories/GHSA-j7q2-c6r4-x2jw
- https://nvd.nist.gov/vuln/detail/CVE-2020-2238
- https://github.com/jenkinsci/git-parameter-plugin/commit/7014c4dd030ee4226b4795137050743a84d67cb0