PT-2020-15346 · Jenkins · Jenkins Timestamper Plugin+1

Wadeck Follonier · Published 2020-03-09 · Updated 2023-11-02 · CVE-2020-2137

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Timestamper Plugin versions 1.11.1 and earlier

Description The issue results in a stored cross-site scripting vulnerability due to the lack of sanitization of HTML formatting in the output. This can be exploited by attackers with Overall/Administer permission. The vulnerability allows malicious users to inject HTML code, potentially leading to unauthorized actions.

Recommendations For Jenkins Timestamper Plugin versions 1.11.1 and earlier, update to version 1.11.2 or later, which sanitizes the HTML formatting for timestamps and only allows basic, safe HTML formatting.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2137

GHSA-6XXF-RWV4-MRJM

Affected Products

Jenkins

Jenkins Timestamper Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-6xxf-rwv4-mrjm · Vendor Advisory
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2137 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2137 · Vendor Advisory
• https://github.com/jenkinsci/timestamper-plugin/commit/6637c3e599c330e03251005675beeadb46d8495b · Note
• https://github.com/jenkinsci/timestamper-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note