CVE-2020-2169: Reflected XSS vulnerability in Jenkins Queue cleanup Plugin
Summary
CVE-2020-2169: Reflected XSS vulnerability in Jenkins Queue cleanup Plugin. Affects org.jenkins-ci.plugins:queue-cleanup versions < 1.4. Fixed in 1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Queue cleanup Plugin is a Maven package (org.jenkins-ci.plugins:queue-cleanup) that provides functionality for cleaning up the Jenkins build queue. It is responsible for removing stale or expired build requests from the queue. The plugin helps optimize the build queue and improve overall system performance.
Vulnerability Detail
The Queue cleanup Plugin version 1.3 and earlier is vulnerable to a reflected cross-site scripting (XSS) attack. The vulnerability arises from a form validation HTTP endpoint that fails to properly escape a query parameter displayed in an error message. An attacker can exploit this vulnerability by injecting malicious code into the query parameter, which will be executed when the error message is displayed to a user. This can lead to various security risks, including unauthorized access, data theft, and potential compromise of the Jenkins system.
How To Fix
Minimum fixed version
1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version (1.4 or later) to mitigate the risk of exploitation.
Conclusion
The Jenkins Queue cleanup Plugin version 1.3 and earlier is vulnerable to a reflected XSS attack. To mitigate this vulnerability, it is crucial to update to version 1.4 or later. This update fixes the issue by properly escaping the query parameter. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:queue-cleanup →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized access, data theft, and compromise of the Jenkins system.
No, authentication is not required. The vulnerability can be exploited by any user who can access the affected Jenkins instance.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
Yes, this vulnerability can be exploited remotely. An attacker can inject malicious code through a crafted request, and the code will be executed when the error message is displayed to a user.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
