CVE-2020-2136: XSS
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation resulting in a stored cross-site scripting vulnerability.
Other sources
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:gitto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
azurelinux/gitto a version that resolves this vulnerability.Fixed in 2.23.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2136?
The severity of CVE-2020-2136 is medium with a CVSS score of 5.4.
What is the vulnerability description of CVE-2020-2136?
CVE-2020-2136 is a stored cross-site scripting vulnerability in Jenkins Git Plugin 4.2.0 and earlier due to the error message not being escaped for the repository URL for Microsoft TFS field form validation.
How can I mitigate CVE-2020-2136?
To mitigate CVE-2020-2136, update Jenkins Git Plugin to version 4.2.1 or later.