CVE-2020-2257: XSS
First published: Wed Sep 16 2020(Updated: )
Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Validating String Parameter | <=2.4 | |
| maven/org.jenkins-ci.plugins:validating-string-parameter | <=2.4 | 2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/09/16/3
- https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1935
- https://nvd.nist.gov/vuln/detail/CVE-2020-2257
- https://github.com/jenkinsci/validating-string-parameter-plugin/commit/345a79d830a5fcd824a3c755506a438c78c48117
- https://github.com/advisories/GHSA-fvwh-wv43-8qj5 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this Jenkins plugin?
The vulnerability ID for this Jenkins plugin is CVE-2020-2257.
What is the title of this vulnerability?
The title of this vulnerability is 'Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields'.
What is the severity of this vulnerability?
The severity of this vulnerability is medium (5.4).
How can this vulnerability be exploited?
This vulnerability can be exploited by attackers with Job/Configure permission using stored cross-site scripting (XSS).
How can I fix this vulnerability?
To fix this vulnerability, you should update Jenkins Validating String Parameter Plugin to the latest version.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-fvwh-wv43-8qj5
- alias/CVE-2020-2257
- collector/nvd-cve
- collector/github-advisory
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/weakness
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins validating string parameter
- version/jenkins validating string parameter/2.4
- package-manager/maven