Reflected Cross-Site Scripting Vulnerability in Jenkins Audit Trail Plugin
CVE-2020-2140

6.1MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Audit Trail Plugin
Vendor
CVE Published:
9 March 2020

Summary

The Jenkins Audit Trail Plugin versions up to 3.2 are susceptible to a reflected cross-site scripting vulnerability due to improper escaping of error messages within the URL Patterns field form validation. This flaw could allow an attacker to inject malicious scripts, which may be executed in the context of the user's session, compromising the integrity of user data and potentially leading to unauthorized actions within the Jenkins environment.

Affected Version(s)

Jenkins Audit Trail Plugin <= 3.2

References

https://jenkins.io/security/advisory/2020-03-09/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2020/03/09/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.