CVE-2020-2225: Stored XSS vulnerability in Jenkins Matrix Project Plugin
Summary
CVE-2020-2225: Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin. Affects org.jenkins-ci.plugins:matrix-project versions < 1.17. Fixed in 1.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Matrix Project Plugin is a Maven package that provides functionality for creating matrix projects in Jenkins. Matrix projects allow users to run multiple builds with different combinations of parameters, known as axes. This plugin is widely used in Jenkins installations to manage complex build configurations and test scenarios.
Vulnerability Detail
The Matrix Project Plugin version 1.16 and earlier contains a stored cross-site scripting (XSS) vulnerability. The issue arises from the lack of proper escaping of axis names shown in tooltips on the overview page of builds with multiple axes. This vulnerability can be exploited by authenticated users with Job/Configure permission. An attacker could inject malicious scripts into the axis names, which would then be executed when viewed by other users with access to the affected page. The impact of this vulnerability can range from unauthorized data disclosure to complete control over the affected user's session.
How To Fix
Minimum fixed version
1.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.17 is not immediately feasible, a temporary workaround is to restrict access to the affected page to trusted users only. This can be done by adjusting the permissions in the Jenkins configuration to limit Job/Configure permission to trusted individuals. Additionally, it is advisable to sanitize any user input before displaying it in tooltips or other user-facing elements.
Conclusion
The Matrix Project Plugin version 1.16 and earlier is vulnerable to a stored XSS vulnerability that can be exploited by authenticated users with Job/Configure permission. Upgrading to version 1.17 or later is recommended to fix this issue. In the meantime, restricting access to the affected page and sanitizing user input can serve as temporary mitigations. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:matrix-project →
FAQ
The vulnerability allows for the execution of arbitrary scripts in the context of other users, potentially leading to unauthorized data disclosure or complete control over their sessions.
Authenticated users with Job/Configure permission can exploit this vulnerability.
Yes, upgrading to Matrix Project Plugin version 1.17 or later fixes this vulnerability.
A temporary workaround is to restrict access to the affected page to trusted users and sanitize user input before displaying it in tooltips.
Yes, the CVSS score for this vulnerability is 8.0 (High severity).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:matrix-project.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
