CVE-2020-2137: Stored XSS vulnerability in Jenkins Timestamper Plugin
Summary
CVE-2020-2137: Stored XSS vulnerability in Jenkins Timestamper Plugin. Affects org.jenkins-ci.plugins:timestamper versions < 1.11.2. Fixed in 1.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Timestamper Plugin is a Maven-based open-source plugin that provides timestamping functionality for console output in Jenkins builds. It allows users to view the timestamps of various events during the build process. This plugin is widely used in Jenkins installations to track the timing of build steps and diagnose issues. However, versions 1.11.1 and earlier of the Timestamper Plugin contain a vulnerability that exposes users to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The Timestamper Plugin versions 1.11.1 and earlier do not properly escape or sanitize the HTML formatting used to display timestamps in console output. This allows an attacker to inject malicious HTML or JavaScript code into the console output, which will be executed when viewed by users with Overall/Administer permission. The stored XSS vulnerability can be exploited to steal sensitive information, perform actions on behalf of the user, or launch further attacks within the Jenkins environment. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.11.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround is to restrict access to the Jenkins instance and limit the permissions of users with Overall/Administer privileges. By reducing the number of users with such permissions, the potential attack surface is minimized. Additionally, it is advisable to educate users about the risks of viewing untrusted console output and encourage them to exercise caution.
Conclusion
The Jenkins Timestamper Plugin versions 1.11.1 and earlier are vulnerable to a stored XSS attack, which can be exploited by users with Overall/Administer permission. Upgrading to version 1.11.2 or later is strongly recommended to mitigate the risk. Restricting access and educating users about the vulnerability are additional measures that can be taken. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:timestamper →
FAQ
The vulnerability allows an attacker to execute arbitrary code within the Jenkins environment, potentially leading to unauthorized access, data theft, or further exploitation of the system.
Users of Jenkins Timestamper Plugin versions 1.11.1 and earlier are affected by this vulnerability. Specifically, users with Overall/Administer permission are at risk.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is important to promptly apply the recommended fix to mitigate the risk.
Applying the recommended fix by upgrading to Timestamper Plugin version 1.11.2 or later is the most effective mitigation. Restricting access to the Jenkins instance and educating users about the risks can also help reduce the attack surface.
Yes, the CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
