CVE-2020-2271: Stored XSS vulnerability in Locked Files Report Plugin
Summary
CVE-2020-2271: Stored XSS vulnerability in Locked Files Report Plugin. Affects org.jvnet.hudson.plugins:locked-files-report versions < 1.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Locked Files Report Plugin is a plugin for Jenkins, an open-source automation server. It provides a report on locked files in Jenkins, allowing users to identify and manage locked files. The plugin is an essential tool for Jenkins administrators and users who need to track and resolve file locking issues. However, versions 1.6 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Locked Files Report Plugin arises from a failure to properly escape locked files' names in tooltips. This allows an attacker with Job/Configure permission to inject malicious scripts into the tooltips, which will be executed when a user hovers over the locked file. The stored XSS vulnerability can lead to various attacks, including session hijacking, defacement of the Jenkins interface, and stealing sensitive information. The vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a non-vulnerable version of the Locked Files Report Plugin.
Conclusion
The Stored XSS vulnerability in the Locked Files Report Plugin can have severe consequences, including session hijacking and data theft. It is crucial for users of Jenkins to upgrade to a non-vulnerable version of the plugin (1.7 or later) to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jvnet.hudson.plugins:locked-files-report →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, defacement of the Jenkins interface, and theft of sensitive information.
Users of Jenkins who have installed the Locked Files Report Plugin version 1.6 or earlier are affected by this vulnerability.
There are currently no known public exploits for this vulnerability. However, it is crucial to apply the recommended fix to prevent potential exploitation.
No, this vulnerability requires an attacker to have Job/Configure permission in Jenkins to exploit the stored XSS vulnerability.
Yes, this vulnerability has a CVSS score of 8.0, indicating a high severity level.
