PT-2020-15345 · Jenkins · Jenkins Git Plugin+1

Wadeck Follonier · CVE-2020-2136 · Published 2020-03-09 · Updated 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git Plugin versions 4.2.0 and earlier

Description The issue results from the failure to escape the error message for the repository URL for Microsoft TFS field form validation, leading to a stored cross-site scripting issue.

Recommendations For Jenkins Git Plugin versions 4.2.0 and earlier, update to a version later than 4.2.0 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2136

GHSA-6C7R-6P5M-CP82

RHSA-2020:2478

RHSA-2020:2737

RHSA-2020:3616

Affected Products

Jenkins

Jenkins Git Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2020-2136 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6c7r-6p5m-cp82 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2136 · Security Note
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1723 · Vendor Advisory
• https://github.com/jenkinsci/git-plugin/commit/f581998be38cfed8e080c672c4b7caa8b4a45979 · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note