PT-2020-15329 · Jenkins · Jenkins Brakeman Plugin+1

Adith Sudhakar · Published 2020-02-12 · Updated 2023-10-25 · CVE-2020-2122

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Brakeman Plugin versions 0.12 and earlier

Description The issue is related to a stored cross-site scripting vulnerability. It occurs because the plugin does not escape values received from parsed JSON files when rendering them. This vulnerability can be exploited by users who can control the Brakeman post-build step input data.

Recommendations For Jenkins Brakeman Plugin versions 0.12 and earlier, update to version 0.13 or later to resolve the issue. Note that the fix in version 0.13 only applies to newly recorded data after the updated plugin is installed, and historical data may still contain unsafe values. As a temporary workaround, consider restricting access to the Brakeman post-build step input data to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2122

GHSA-7Q9R-VHG2-789W

Affected Products

Jenkins

Jenkins Brakeman Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2122 · Security Note
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1644 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2122 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7q9r-vhg2-789w · Vendor Advisory
• https://github.com/jenkinsci/brakeman-plugin · Note
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note
• https://t.me/cvenotify/921 · Telegram Post