Reflected XSS Vulnerability in Gitlab Hook Plugin for Jenkins
CVE-2020-2096

6.1MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Gitlab Hook Plugin
Vendor
CVE Published:
15 January 2020

What is CVE-2020-2096?

The Jenkins Gitlab Hook Plugin prior to version 1.4.2 contains a reflected Cross-Site Scripting (XSS) vulnerability due to inadequate escaping of project names in the build_now endpoint. An attacker could exploit this flaw to inject and execute arbitrary scripts in the context of the user's session, compromising web application security and allowing for potential data exfiltration or unauthorized operations. It is crucial for administrators to update to the latest version to mitigate this risk.

Affected Version(s)

Jenkins Gitlab Hook Plugin <= 1.4.2

References

https://jenkins.io/security/advisory/2020-01-15/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2020/01/15/1
mailing-listx_refsource_MLIST
http://packetstormsecurity.com/files/155967/Jenkins-Gitla...
x_refsource_MISC

EPSS Score

93% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-2096 : Reflected XSS Vulnerability in Gitlab Hook Plugin for Jenkins