PT-2020-15482 · Jenkins · Jenkins Validating String Parameter Plugin+1

Daniel Beck + 1 · Published 2020-09-16 · Updated 2023-11-02 · CVE-2020-2257

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Validating String Parameter Plugin versions 2.4 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability, which can be exploited by attackers with Job/Configure permission. This occurs because the plugin does not properly escape various user-controlled fields, including regular expressions in tooltips, parameter names, and parameter descriptions.

Recommendations For Jenkins Validating String Parameter Plugin versions 2.4 and earlier, update to version 2.5 or later, which escapes regular expressions in tooltips and parameter names, and renders parameter descriptions using the configured markup formatter.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2257

GHSA-FVWH-WV43-8QJ5

Affected Products

Jenkins

Jenkins Validating String Parameter Plugin

References · 7

• https://jenkins.io/security/advisory/2020-09-16/#SECURITY-1935 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2257 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvwh-wv43-8qj5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2257 · Security Note
• https://github.com/jenkinsci/validating-string-parameter-plugin · Note
• https://github.com/jenkinsci/validating-string-parameter-plugin/commit/345a79d830a5fcd824a3c755506a438c78c48117 · Note
• http://openwall.com/lists/oss-security/2020/09/16/3 · Note