CVE-2020-2175: Stored XSS vulnerability in Jenkins FitNesse Plugin
Summary
CVE-2020-2175: Stored XSS vulnerability in Jenkins FitNesse Plugin. Affects org.jenkins-ci.plugins:fitnesse versions < 1.32. Fixed in 1.32. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins FitNesse Plugin is a Maven-based plugin that integrates FitNesse, a web server and wiki for organizing and executing acceptance tests, with Jenkins, an open-source automation server. It allows users to run FitNesse tests as part of their Jenkins build process. The plugin processes XML input files to generate reports that are displayed on the Jenkins UI.
Vulnerability Detail
The FitNesse Plugin versions 1.31 and earlier have a stored cross-site scripting (XSS) vulnerability. The plugin fails to properly escape report contents before rendering them on the Jenkins UI. This allows users who can control the XML input files processed by the plugin to inject malicious scripts into the reports. An attacker could exploit this vulnerability to execute arbitrary code in the context of other users who view the affected reports. The vulnerability has a CVSSv3 score of 5.4 (Medium severity).
How To Fix
Minimum fixed version
1.32
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the FitNesse Plugin.
Conclusion
The Jenkins FitNesse Plugin versions 1.31 and earlier are vulnerable to a stored XSS vulnerability that allows for the execution of arbitrary code. Users should upgrade to version 1.33 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:fitnesse →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of other users who view the affected reports. This can lead to unauthorized access, data theft, or further compromise of the Jenkins environment.
Users of Jenkins FitNesse Plugin versions 1.31 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, upgrading to FitNesse Plugin version 1.33 or later fixes this vulnerability.
The only mitigation is to upgrade to the fixed version of the FitNesse Plugin.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:fitnesse.
