Stored Cross-Site Scripting Vulnerability in Jenkins Script Security Plugin
CVE-2020-2190

5.4MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Script Security Plugin
Vendor
CVE Published:
3 June 2020

Summary

The Jenkins Script Security Plugin versions up to 1.72 have a vulnerability that arises from improper escaping of pending or approved classpath entries on the In-process Script Approval page. This flaw allows for the potential execution of malicious scripts, leading to a stored cross-site scripting (XSS) vulnerability that can adversely affect users interacting with the compromised plugin. Organizations using affected versions should consider updating to address this security issue.

Affected Version(s)

Jenkins Script Security Plugin <= 1.72

References

https://jenkins.io/security/advisory/2020-06-03/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2020/06/03/3
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.