CVE-2020-2112: Jenkins Git Parameter Plugin Stored XSS Vulnerability
Summary
CVE-2020-2112: Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS). Affects org.jenkins-ci.tools:git-parameter versions < 0.9.12. Fixed in 0.9.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Parameter Plugin is a Maven package (org.jenkins-ci.tools:git-parameter) that provides functionality for integrating Git repositories with Jenkins. It allows users to define parameters for Jenkins jobs that are populated with Git branch names, tags, or revisions. These parameters can be used to customize job behavior and enable dynamic configuration. However, versions 0.9.11 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins Git Parameter Plugin arises from a failure to properly escape the parameter name displayed on the user interface. This allows an attacker with Job/Configure permission to inject malicious JavaScript code into the parameter name, which is then stored and executed when the parameter is rendered on the UI. As a result, an attacker can exploit this vulnerability to execute arbitrary code in the context of other users who view or interact with the affected Jenkins job. The impact of this vulnerability can range from stealing sensitive information to performing actions on behalf of the victim user.
How To Fix
Minimum fixed version
0.9.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the Jenkins Git Parameter Plugin as soon as possible.
Conclusion
The Jenkins Git Parameter Plugin versions 0.9.11 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. This can allow an attacker to execute arbitrary code in the context of other users, potentially leading to the theft of sensitive information or unauthorized actions. It is crucial for users to upgrade to version 0.9.12 or later of the plugin to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.tools:git-parameter →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of other users who view or interact with the affected Jenkins job. This can lead to the theft of sensitive information or unauthorized actions performed on behalf of the victim user.
Users of Jenkins Git Parameter Plugin versions 0.9.11 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is advisable to upgrade to the latest version of the plugin to mitigate the risk.
Yes, users should upgrade to version 0.9.12 or later of the Jenkins Git Parameter Plugin to fix this vulnerability.
Users can update the plugin by following the standard procedure for updating Jenkins plugins. This typically involves accessing the Jenkins administration interface, navigating to the Manage Plugins section, and selecting the available updates for installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.tools:git-parameter.
