PT-2020-15383 · Jenkins · Jenkins Gatling Plugin+1

Daniel Beck · Published 2020-04-07 · Updated 2023-11-02 · CVE-2020-2173

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Gatling Plugin versions 1.2.7 and earlier

Description The issue results in a cross-site scripting (XSS) vulnerability, which is exploitable by users able to change report content. This occurs because the plugin prevents Content-Security-Policy headers from being set for Gatling reports, effectively bypassing the Content-Security-Policy protection introduced in certain Jenkins versions.

Recommendations For versions 1.2.7 and earlier, consider updating to version 1.3.0 or later, which no longer allows viewing Gatling reports directly in Jenkins, thereby mitigating the risk of exploitation. As a temporary workaround, consider restricting access to the Gatling reports served by the plugin until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2173

GHSA-HV53-QJG6-5PM9

Affected Products

Jenkins

Jenkins Gatling Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2020-2173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2173 · Security Note
• https://osv.dev/vulnerability/GHSA-hv53-qjg6-5pm9 · Vendor Advisory
• https://github.com/jenkinsci/gatling-plugin/commit/8a9ae59c6b3328776d38af6596b35cef1ced05a7 · Note
• https://t.me/cvenotify/2475 · Telegram Post
• http://openwall.com/lists/oss-security/2020/04/07/3 · Note
• https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1633 · Note
• ttps://github.com/jenkinsci/gatling-plugin · Note