PT-2020-2657 · Jenkins · Jenkins Queue Cleanup Plugin+1

Wadeck Follonier · Published 2020-03-25 · Updated 2023-11-02 · CVE-2020-2169

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Queue cleanup Plugin versions 1.3 and earlier

Description The issue is related to a form validation endpoint in the Jenkins Queue cleanup Plugin that does not properly escape a query parameter displayed in an error message, resulting in a reflected cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by a remote attacker to perform cross-site scripting attacks. The plugin's failure to protect its web page structure is a key factor in this vulnerability.

Recommendations For Jenkins Queue cleanup Plugin versions 1.3 and earlier, update to version 1.4 or later, which correctly escapes the query parameter and resolves the issue. As a temporary workaround, consider restricting access to the form validation endpoint until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-02701

CVE-2020-2169

GHSA-M7PR-M4CX-6M22

Affected Products

Jenkins

Jenkins Queue Cleanup Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2020-2169 · Security Note
• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m7pr-m4cx-6m22 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02701 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2169 · Vendor Advisory
• https://github.com/jenkinsci/queue-cleanup-plugin · Note
• https://github.com/jenkinsci/queue-cleanup-plugin/commit/b3e562a427e704fc15dafe7664bd67aafcd4e03e · Note
• https://github.com/jenkinsci/queue-cleanup-plugin/commit/e7dae99aa3a414004e953303c7c687d65348de11 · Note
• http://openwall.com/lists/oss-security/2020/03/25/2 · Note
• https://openwall.com/lists/oss-security/2020/03/25/2 · Note