CVE-2020-2292: Stored XSS vulnerability in Jenkins Release Plugin
Summary
CVE-2020-2292: Stored XSS vulnerability in Jenkins Release Plugin. Affects org.jenkins-ci.plugins:release versions < 2.11. Fixed in 2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Release Plugin is a Maven ecosystem package that allows users to automate the release process of their software projects. It provides features such as version management, tagging, and publishing of releases. This plugin is widely used in Jenkins CI/CD pipelines for software development and deployment.
Vulnerability Detail
The Jenkins Release Plugin version 2.10.2 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises from the plugin's failure to properly escape the release version in the badge tooltip. Attackers with Release/Release permission can exploit this vulnerability to inject malicious scripts into the tooltip, which will be executed when a user hovers over the badge. The impact of this vulnerability can range from unauthorized data disclosure to full control of the affected Jenkins instance.
How To Fix
Minimum fixed version
2.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround is to disable the display of the release version in the badge tooltip. This can be achieved by modifying the plugin configuration or removing the badge from the Jenkins UI. However, this workaround may impact the visibility of release information for users.
Conclusion
The Jenkins Release Plugin version 2.10.2 and earlier is vulnerable to a stored XSS attack. It is crucial to upgrade to version 2.11 or later to mitigate this vulnerability. Users should also consider implementing the recommended workaround if immediate upgrade is not possible. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:release →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the context of the affected user's browser, potentially leading to unauthorized data disclosure or complete compromise of the Jenkins instance.
Attackers with Release/Release permission in the Jenkins instance can exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:release.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
