CVE-2020-2140: XSS vulnerability in Jenkins Audit Trail Plugin
Summary
CVE-2020-2140: XSS vulnerability in Jenkins Audit Trail Plugin. Affects org.jenkins-ci.plugins:audit-trail versions < 3.3. Fixed in 3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Audit Trail Plugin is a Maven-based plugin that provides an audit trail for Jenkins, a popular open-source automation server. It allows administrators to track and monitor user activity, providing valuable insights for security and compliance purposes. The plugin is an essential component for organizations using Jenkins to manage their software development and deployment processes.
Vulnerability Detail
The Jenkins Audit Trail Plugin version 3.2 and earlier is vulnerable to a reflected cross-site scripting (XSS) attack. The vulnerability arises from the plugin's failure to properly escape the error message for the URL Patterns field form validation. An attacker can exploit this vulnerability by injecting malicious code into the URL Patterns field, which will be executed when the error message is displayed to a user. This can lead to various consequences, including unauthorized access, data theft, and further exploitation of the affected system. The vulnerability has been assigned a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 3.3 is not immediately feasible, a temporary workaround is to disable the affected URL Patterns field in the plugin configuration. This can be done by removing or commenting out the corresponding configuration entry in the plugin's configuration file. However, this workaround should only be considered as a temporary measure, and upgrading to the latest version is strongly recommended.
Conclusion
The XSS vulnerability in the Jenkins Audit Trail Plugin can have serious consequences, including unauthorized access and data theft. It is crucial for administrators to promptly upgrade to version 3.3 or later of the plugin to mitigate the vulnerability. Additionally, it is recommended to regularly monitor for vulnerabilities in open-source software using tools like Vulert (https://vulert.com) to ensure the security of your applications.
See every vulnerability recorded for org.jenkins-ci.plugins:audit-trail →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized access, data theft, and further exploitation of the affected system.
No, only versions 3.2 and earlier are affected. Version 3.3 and later include the necessary fix to mitigate the vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fix to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can inject malicious code into the URL Patterns field, which will be executed when the error message is displayed to a user accessing the affected Jenkins instance.
Yes, this vulnerability has been assigned a CVSS score of 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:audit-trail.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
