GitHub Advisoryadvisory · Maven

GHSA-5x89-75r7-8rjh XSS vulnerability in Jenkins useMango Runner Plugin

MEDIUM Published 2022-05-24 Modified 2022-12-20 Official page ↗
Aliases
CVE-2020-2176
Ecosystem
Maven
Packages
it.infuse.jenkins:usemango-runner
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-12-20

Affected packages

• Maven it.infuse.jenkins:usemango-runner: < 1.5 → fixed in 1.5

Description

Multiple form validation endpoints in useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service. This results in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from the useMango service. useMango Runner Plugin 1.5 escapes all values received from the useMango service in form validation messages.

Related

Alias · CVE (1)

  • CVE-2020-2176 Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References