PT-2020-15487 · Jenkins · Jenkins Android Lint Plugin+1

Wadeck Follonier · Published 2020-09-16 · Updated 2023-11-02 · CVE-2020-2262

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Android Lint Plugin versions 2.6 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the plugin does not escape the annotation message in tooltips. This can be exploited by attackers who can provide report files to the plugin's post-build step.

Recommendations For Jenkins Android Lint Plugin versions 2.6 and earlier, update to a version later than 2.6 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2262

GHSA-28X9-HC4P-9VH2

Affected Products

Jenkins

Jenkins Android Lint Plugin

References · 6

• https://jenkins.io/security/advisory/2020-09-16/#SECURITY-1908 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2262 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-28x9-hc4p-9vh2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2262 · Security Note
• https://github.com/jenkinsci/android-lint-plugin · Note
• http://openwall.com/lists/oss-security/2020/09/16/3 · Note