CVE-2020-2201: Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin
Summary
CVE-2020-2201: Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin. Affects org.jenkins-ci.plugins:sonargraph-integration versions < 3.0.1. Fixed in 3.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Sonargraph Integration Plugin is a plugin for Jenkins, an open-source automation server. It allows users to integrate Sonargraph, a software architecture and quality management tool, into their Jenkins workflows. The plugin provides functionality to analyze and visualize software metrics, dependencies, and architecture violations. It is commonly used in software development projects to ensure code quality and maintainability.
Vulnerability Detail
The Sonargraph Integration Plugin version 3.0.0 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The vulnerability arises from the plugin's failure to properly escape the file path for the Log file field form validation. This allows an attacker with Job/Configure permission to inject malicious scripts into the plugin's error message, which can then be executed when viewed by other users. The impact of this vulnerability can range from unauthorized data access to complete system compromise, depending on the privileges of the affected user.
How To Fix
Minimum fixed version
3.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict Job/Configure permission to trusted individuals only. This can help mitigate the risk of exploitation by limiting the number of users who can inject malicious scripts. However, this workaround does not address the root cause of the vulnerability and should be considered a temporary measure until the plugin is updated.
Conclusion
The Sonargraph Integration Plugin version 3.0.0 and earlier is vulnerable to a stored XSS attack. Users are advised to update to version 3.0.1 or later to mitigate the risk. Restricting Job/Configure permission to trusted individuals can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:sonargraph-integration →
FAQ
The impact of this vulnerability can range from unauthorized data access to complete system compromise, depending on the privileges of the affected user.
Users with Job/Configure permission in Jenkins can exploit this vulnerability.
Yes, the vulnerability can be fixed by upgrading to Sonargraph Integration Plugin version 3.0.1 or later.
As a temporary workaround, users can restrict Job/Configure permission to trusted individuals only.
There is no known public exploit for this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:sonargraph-integration.
