CVE-2020-2195: Stored XSS vulnerability in Jenkins Compact Columns Plugin
Summary
CVE-2020-2195: Stored XSS vulnerability in Jenkins Compact Columns Plugin. Affects org.jenkins-ci.plugins:compact-columns versions < 1.12. Fixed in 1.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Compact Columns Plugin is a Maven-based plugin that provides a compact view of Jenkins job columns. It allows users to customize the display of job information in a condensed format. The plugin is widely used in Jenkins instances to improve the visibility and organization of job data. However, versions 1.11 and earlier of the Compact Columns Plugin suffer from a stored cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The stored XSS vulnerability in the Compact Columns Plugin arises from the plugin's display of unprocessed job descriptions in tooltips. This allows an attacker with Job/Configure permission to inject malicious scripts into the job description, which will be executed when a user hovers over the tooltip. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level. Exploitation of this vulnerability can lead to unauthorized access, data theft, or other malicious actions.
How To Fix
Minimum fixed version
1.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.12 is not immediately feasible, a temporary workaround is to disable tooltips for job descriptions in the Jenkins configuration. This can be done by navigating to 'Manage Jenkins' > 'Configure System' > 'Compact Columns Plugin' and unchecking the 'Enable tooltips for job descriptions' option.
Conclusion
The stored XSS vulnerability in Jenkins Compact Columns Plugin can be mitigated by upgrading to version 1.12 or later. It is recommended to promptly apply the fix to prevent potential exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:compact-columns →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious actions.
Users of Compact Columns Plugin versions 1.11 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, upgrading to Compact Columns Plugin version 1.12 or later will mitigate this vulnerability.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
