PT-2020-15435 · Jenkins · Jenkins Link Column Plugin+1

Daniel Beck · Published 2020-07-02 · Updated 2023-10-25 · CVE-2020-2219

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Link Column Plugin versions 1.0 and earlier

Description The issue concerns a stored cross-site scripting vulnerability. It allows users with View/Configure permission to create links that can execute JavaScript code due to the lack of URL filtering for links created by these users. The javascript: scheme is permitted, which can be exploited by users who can configure list views.

Recommendations For Jenkins Link Column Plugin versions 1.0 and earlier, consider disabling the ability for users to add new columns with user-configurable links until a patch is available. Restrict access to the link creation feature to minimize the risk of exploitation. Avoid using the Link Column Plugin to add links that could potentially contain the javascript: scheme until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2219

GHSA-Q2MM-W3QC-2936

Affected Products

Jenkins

Jenkins Link Column Plugin

References · 6

• https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1803 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2219 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q2mm-w3qc-2936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2219 · Security Note
• https://github.com/jenkinsci/link-column-plugin · Note
• http://openwall.com/lists/oss-security/2020/07/02/7 · Note