CVE-2020-2265: Stored XSS vulnerability in Coverage/Complexity Scatter Plot Plugin
Summary
CVE-2020-2265: Stored XSS vulnerability in Coverage/Complexity Scatter Plot Plugin. Affects org.jenkins-ci.plugins:covcomplplot versions < 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Coverage/Complexity Scatter Plot Plugin is a plugin for Jenkins, an open-source automation server. This plugin provides a scatter plot graph that visualizes the relationship between code coverage and complexity metrics. It allows users to analyze the quality of their codebase by identifying areas with low coverage and high complexity. The plugin integrates with Jenkins' post-build step to generate the scatter plot based on report files provided by the user.
Vulnerability Detail
The Jenkins Coverage/Complexity Scatter Plot Plugin version 1.1.1 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin fails to properly escape the method information in tooltips, making it possible for an attacker to inject malicious scripts into the tooltips. This vulnerability can be exploited by attackers who are able to provide report files to the plugin's post-build step. If a user hovers over the tooltip containing the injected script, the script will be executed in the context of the user's browser, potentially leading to unauthorized actions or data theft.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the patch provided by the plugin developers to mitigate the risk of exploitation.
Conclusion
The Jenkins Coverage/Complexity Scatter Plot Plugin version 1.1.1 and earlier is vulnerable to a stored XSS attack. Users of the plugin should upgrade to version 1.1.2 or later to mitigate the risk of exploitation. It is important to keep software dependencies up to date and follow secure coding practices to minimize the impact of vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:covcomplplot →
FAQ
A stored XSS vulnerability occurs when an application stores user-supplied data without properly sanitizing or escaping it. This allows an attacker to inject malicious scripts that are then executed by other users who view the affected content.
By exploiting this vulnerability, an attacker can execute arbitrary scripts in the context of other users' browsers. This can lead to various malicious actions, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or spreading malware.
Users of Jenkins who have the Coverage/Complexity Scatter Plot Plugin version 1.1.1 or earlier installed are affected by this vulnerability. It is recommended for all users of the plugin to update to the latest patched version.
There is no known evidence of this vulnerability being exploited in the wild at the time of this advisory. However, it is important to apply the patch as soon as possible to prevent potential exploitation.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-f6mg-hmfp-6grw or the associated CVE-2020-2265.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:covcomplplot.
