CVE-2020-2096: Reflected XSS vulnerability in Jenkins gitlab-hook Plugin
Summary
CVE-2020-2096: Reflected XSS vulnerability in Jenkins gitlab-hook Plugin. Affects org.jenkins-ci.ruby-plugins:gitlab-hook versions < 1.4.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Gitlab Hook Plugin is a Maven package (org.jenkins-ci.ruby-plugins:gitlab-hook) that integrates Jenkins with GitLab. It provides functionality to trigger Jenkins builds when certain events occur in GitLab, such as pushing code or creating merge requests. The plugin allows users to configure webhooks in GitLab to notify Jenkins about these events. However, versions 1.4.2 and earlier of the plugin are vulnerable to a reflected cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins Gitlab Hook Plugin arises from a failure to properly escape project names in the build_now endpoint. This allows an attacker to inject malicious scripts into the project name, which are then executed when the name is displayed in the Jenkins UI. An attacker can exploit this vulnerability by crafting a specially-crafted project name and tricking a user with sufficient privileges to visit a page that displays the project name. The impact of this vulnerability is limited to users who have the ability to create or modify project names in GitLab and trigger Jenkins builds. The vulnerability has a CVSS score of 6.1 (Moderate).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a non-vulnerable version of the Jenkins Gitlab Hook Plugin.
Conclusion
The Jenkins Gitlab Hook Plugin versions 1.4.2 and earlier are vulnerable to a reflected XSS attack due to improper escaping of project names. This vulnerability can be exploited by an attacker to execute arbitrary scripts in the user's browser. Users should upgrade to a non-vulnerable version of the plugin to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.ruby-plugins:gitlab-hook →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of the user's browser, potentially leading to unauthorized actions or data theft.
Users of Jenkins Gitlab Hook Plugin versions 1.4.2 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, users should upgrade to a version of the Jenkins Gitlab Hook Plugin that is not affected by the vulnerability.
No, the vulnerability can only be fixed by upgrading to a non-vulnerable version of the Jenkins Gitlab Hook Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.ruby-plugins:gitlab-hook.
