CVE-2020-2112: XSS
Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.tools:git-parameterto a version that resolves this vulnerability.Fixed in 0.9.12 - Upgrade
Upgrade
Jenkins Git Parameter Pluginto a version that resolves this vulnerability.Fixed in 0.9.11
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2112?
The severity of CVE-2020-2112 is medium with a CVSS score of 5.4.
How does CVE-2020-2112 affect Jenkins Git Parameter Plugin?
CVE-2020-2112 affects Jenkins Git Parameter Plugin version 0.9.11 and earlier.
What is the vulnerability type of CVE-2020-2112?
CVE-2020-2112 is a stored cross-site scripting vulnerability.
Who can exploit the vulnerability in CVE-2020-2112?
The vulnerability in CVE-2020-2112 can be exploited by users with Job/Configure permission.
Are there any fixes available for CVE-2020-2112?
Yes, fixes for CVE-2020-2112 are available. Please refer to the Jenkins security advisory for more information.