CVE-2020-2243: Stored XSS vulnerability in Jenkins Cadence vManager Plugin
Summary
CVE-2020-2243: Stored XSS vulnerability in Jenkins Cadence vManager Plugin. Affects org.jenkins-ci.plugins:vmanager-plugin versions < 3.0.5. Fixed in 3.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins Cadence vManager Plugin is a Maven package that provides functionality for managing builds in Jenkins. It allows users to define and schedule build jobs. The plugin is widely used in software development projects. However, versions 3.0.4 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Jenkins Cadence vManager Plugin arises from the lack of proper escaping of build descriptions in tooltips. This allows attackers with Run/Update permission to inject malicious scripts into the build descriptions, which are then executed when viewed by other users. The impact of this vulnerability can be severe, as it enables attackers to execute arbitrary code in the context of other users, potentially leading to unauthorized access, data theft, or further compromise of the Jenkins environment.
How To Fix
Minimum fixed version
3.0.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The stored XSS vulnerability in Jenkins Cadence vManager Plugin (CVE-2020-2243) allows attackers to execute arbitrary code in the context of other users. It is crucial for users to upgrade to version 3.0.5 or later of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:vmanager-plugin →
FAQ
The vulnerability allows attackers to execute arbitrary code in the context of other users, potentially leading to unauthorized access, data theft, or further compromise of the Jenkins environment.
Users of Jenkins Cadence vManager Plugin versions 3.0.4 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, users should upgrade to version 3.0.5 or later of the Cadence vManager Plugin to fix this vulnerability.
The vulnerability can be mitigated by upgrading to the fixed version of the Cadence vManager Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:vmanager-plugin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
