PT-2020-15464 · Jenkins · Jenkins Cadence Vmanager Plugin+1

Wadeck Follonier · Published 2020-09-01 · Updated 2023-11-02 · CVE-2020-2243

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Cadence vManager Plugin versions 3.0.4 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. This occurs because build descriptions in tooltips are not properly escaped, allowing attackers with Run/Update permission to exploit this weakness.

Recommendations For Jenkins Cadence vManager Plugin versions 3.0.4 and earlier, update to version 3.0.5 or later, which removes the affected tooltips.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2243

GHSA-V46Q-XJP5-7P6R

Affected Products

Jenkins

Jenkins Cadence Vmanager Plugin

References · 6

• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1936 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2243 · Security Note
• https://osv.dev/vulnerability/GHSA-v46q-xjp5-7p6r · Vendor Advisory
• https://github.com/jenkinsci/vmanager-plugin · Note
• http://openwall.com/lists/oss-security/2020/09/01/3 · Note