Stored XSS Vulnerability in Jenkins FitNesse Plugin by Jenkins

CVE-2020-2175

Summary

The Jenkins FitNesse Plugin prior to version 1.32 is susceptible to a stored cross-site scripting vulnerability. The issue arises from the plugin's failure to adequately escape report contents before displaying them on the Jenkins user interface. This vulnerability can be exploited by users who have control over the XML input files that the plugin processes, enabling them to inject malicious scripts that execute in the context of other users, potentially compromising their sessions and sensitive data.

References