PT-2020-15465 · Jenkins · Jenkins Build Failure Analyzer Plugin+1

Wadeck Follonier · Published 2020-09-01 · Updated 2023-11-02 · CVE-2020-2244

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Build Failure Analyzer Plugin versions 1.27.0 and earlier

Description The issue results from the plugin not escaping matching text in a form validation response, leading to a cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can provide console output for builds used to test build log indications.

Recommendations For Jenkins Build Failure Analyzer Plugin versions 1.27.0 and earlier, update to version 1.27.1 or later, which escapes matching text in the affected form validation response.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2244

GHSA-P5JH-8RXP-WQJJ

Affected Products

Jenkins

Jenkins Build Failure Analyzer Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2244 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2244 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1770 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p5jh-8rxp-wqjj · Vendor Advisory
• https://github.com/jenkinsci/build-failure-analyzer-plugin · Note
• https://github.com/jenkinsci/build-failure-analyzer-plugin/commit/c974938f213df0109269cb1b4508b8a1ec19f0ff · Note
• http://openwall.com/lists/oss-security/2020/09/01/3 · Note