PT-2020-15468 · Jenkins · Jenkins Valgrind Plugin+1

Federico Pellegrin · Published 2020-09-01 · Updated 2023-11-02 · CVE-2020-2246

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Valgrind Plugin versions 0.28 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the plugin does not properly escape content in Valgrind XML reports. This allows attackers who can control the contents of these reports to exploit the vulnerability.

Recommendations For Jenkins Valgrind Plugin versions 0.28 and earlier, update to a version later than 0.28 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2246

GHSA-9HCR-66CJ-R9HP

Affected Products

Jenkins

Jenkins Valgrind Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2020-2246 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1830 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2246 · Security Note
• https://osv.dev/vulnerability/GHSA-9hcr-66cj-r9hp · Vendor Advisory
• https://github.com/jenkinsci/valgrind-plugin · Note
• http://openwall.com/lists/oss-security/2020/09/01/3 · Note