CVE-2020-2111: Subversion Plugin stored XSS vulnerability before v2.13.1
Summary
CVE-2020-2111: Subversion Plugin stored XSS vulnerability. Affects org.jenkins-ci.plugins:subversion versions < 2.13.1. Fixed in 2.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Subversion Plugin is a component of Jenkins, an open-source automation server. It allows users to integrate Subversion repositories into their Jenkins projects, enabling version control and continuous integration. The plugin provides functionality for checking out source code, updating, and committing changes to Subversion repositories. However, versions prior to 2.13.1 are susceptible to a stored cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The Subversion Plugin in Jenkins versions 2.13.0 and earlier fails to properly escape the error message for the Project Repository Base URL field form validation. This oversight results in a stored XSS vulnerability, where an attacker can inject malicious code into the error message. When a user with appropriate privileges views the error message, the injected code executes within their browser, potentially leading to unauthorized actions or data theft. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.13.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the display of error messages in the Jenkins user interface. This can be achieved by modifying the Jenkins configuration file and setting the 'hudson.model.Messages.DISPLAY_ERROR_DETAILS' property to 'false'. However, this workaround only hides the error messages and does not address the underlying vulnerability. Upgrading to the fixed version is still the recommended solution.
Conclusion
The Subversion Plugin in Jenkins versions prior to 2.13.1 is vulnerable to a stored XSS attack. Upgrading to version 2.13.1 or later is the recommended solution to address this vulnerability. If immediate upgrade is not possible, disabling error message display can provide a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:subversion →
FAQ
The vulnerability allows an attacker to execute arbitrary code within the context of a user's browser. This can lead to unauthorized actions, data theft, or further exploitation of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this Subversion Plugin XSS vulnerability.
Disabling the display of error messages in the Jenkins user interface can temporarily mitigate the risk of this vulnerability. However, this does not address the underlying issue and upgrading to the fixed version is still recommended.
No, authentication is not required. An attacker can exploit this vulnerability by injecting malicious code into the error message and tricking a user with appropriate privileges to view it.
Yes, this vulnerability has been assigned the CVE identifier CVE-2020-2111.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:subversion.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
