CVE-2020-2238: Stored XSS vulnerability in Jenkins Git Parameter Plugin
Summary
CVE-2020-2238: Stored XSS vulnerability in Jenkins Git Parameter Plugin. Affects org.jenkins-ci.tools:git-parameter versions < 0.9.13. Fixed in 0.9.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Git Parameter Plugin is a Maven package that provides functionality for integrating Git repositories with Jenkins. It allows users to define Git parameters for Jenkins jobs, enabling dynamic configuration and customization. This plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins Git Parameter Plugin version 0.9.12 and earlier is susceptible to a stored cross-site scripting (XSS) vulnerability. This vulnerability arises due to the lack of proper escaping of the repository field on the 'Build with Parameters' page. Attackers with Job/Configure permission can exploit this vulnerability to inject malicious scripts, which will be executed when the vulnerable page is accessed by other users. The impact of this vulnerability can range from unauthorized data disclosure to the execution of arbitrary code within the context of the affected user's session. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-79.
How To Fix
Minimum fixed version
0.9.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by restricting Job/Configure permission to trusted users only. This will limit the potential attackers who can exploit the vulnerability. However, this workaround does not address the root cause and should be considered a temporary solution until the plugin is updated.
Conclusion
The Jenkins Git Parameter Plugin version 0.9.12 and earlier is vulnerable to a stored XSS vulnerability. It is crucial to upgrade to version 0.9.13 or later to mitigate the risk of exploitation. Restricting Job/Configure permission to trusted users can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.tools:git-parameter →
FAQ
The vulnerability allows attackers to execute arbitrary scripts within the context of the affected user's session, potentially leading to unauthorized data disclosure or the execution of malicious code.
Attackers with Job/Configure permission in Jenkins can exploit this vulnerability.
Yes, upgrading to version 0.9.13 or later of the Git Parameter Plugin fixes this vulnerability.
A temporary workaround is to restrict Job/Configure permission to trusted users only. However, this should be considered a temporary solution until the plugin is updated.
The CWE ID associated with this vulnerability is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.tools:git-parameter.
