PT-2020-15421 · Jenkins · Jenkins Vncviewer Plugin+1

Wadeck Follonier · Published 2020-07-02 · Updated 2023-11-02 · CVE-2020-2207

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins VncViewer Plugin versions 1.7 and earlier

Description The issue is related to a reflected cross-site scripting (XSS) vulnerability. It occurs because the checkVncServ form validation endpoint does not properly escape a parameter value, allowing for malicious script injection. The endpoint /checkVncServ is affected, with the parameter value being the vulnerable parameter. This vulnerability can be exploited by injecting malicious code into the endpoint output.

Recommendations For Jenkins VncViewer Plugin versions 1.7 and earlier, update to version 1.8 or later, which properly escapes the parameter value in the checkVncServ form validation endpoint output. As a temporary workaround, consider restricting access to the /checkVncServ endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2207

GHSA-2J4H-CJGH-659V

Affected Products

Jenkins

Jenkins Vncviewer Plugin

References · 8

• https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1776 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2j4h-cjgh-659v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2207 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2207 · Vendor Advisory
• https://github.com/jenkinsci/vncviewer-plugin/commit/99b2aa3ed0857ef35de9a3aca0b0c53add3b392d · Note
• https://github.com/jenkinsci/vncviewer-plugin · Note
• http://openwall.com/lists/oss-security/2020/07/02/7 · Note
• https://t.me/cvenotify/4814 · Telegram Post