CVE-2020-2289: Stored XSS vulnerability in Jenkins Active Choices Plugin
Summary
CVE-2020-2289: Stored XSS vulnerability in Jenkins Active Choices Plugin. Affects org.biouno:uno-choice versions < 2.5. Fixed in 2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Active Choices Plugin is a popular plugin used for creating dynamic and interactive build parameters in Jenkins. It allows users to define parameters with customizable options and descriptions, enhancing the flexibility and interactivity of Jenkins builds. However, versions 2.4 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises from the lack of proper escaping of the name and description of build parameters, which can be exploited by attackers with Job/Configure permission.
Vulnerability Detail
The stored XSS vulnerability in the Jenkins Active Choices Plugin (CVE-2020-2289) allows attackers with Job/Configure permission to inject malicious scripts into the name and description fields of build parameters. When these parameters are rendered in the Jenkins user interface, the injected scripts are executed in the context of the victim's browser, potentially leading to unauthorized actions or data theft. The vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
Minimum fixed version
2.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 2.5 is not immediately feasible, a temporary workaround is to restrict Job/Configure permission to trusted users only. By limiting access to the configuration of Jenkins jobs, the risk of exploitation can be mitigated. However, this workaround does not address the underlying vulnerability and should be considered a temporary measure until the plugin can be updated.
Conclusion
The Jenkins Active Choices Plugin versions 2.4 and earlier are vulnerable to a stored XSS attack, allowing attackers with Job/Configure permission to execute arbitrary scripts in the context of the victim's browser. To mitigate this vulnerability, it is recommended to upgrade to version 2.5 or later of the plugin. Alternatively, restricting Job/Configure permission to trusted users can provide temporary protection. For further assistance or information on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.biouno:uno-choice →
FAQ
The vulnerability allows attackers with Job/Configure permission to execute arbitrary scripts in the context of the victim's browser. This can lead to unauthorized actions, data theft, or the compromise of sensitive information.
Users of Jenkins Active Choices Plugin versions 2.4 and earlier are affected by this vulnerability. Specifically, attackers with Job/Configure permission can exploit the vulnerability.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix or workaround as soon as possible to prevent potential exploitation.
There are alternative plugins available for Jenkins that provide similar functionality to the Active Choices Plugin. However, it is important to note that the vulnerability described in this advisory is specific to the Active Choices Plugin and does not affect other plugins or solutions.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-9jv5-wf44-8vfm or the CVE-2020-2289 entry. Additionally, you can reach out to info@devnack.com for further support on vulnerability remediation.
Related vulnerabilities
Recent vulnerabilities recorded for org.biouno:uno-choice.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
