GitHub Advisoryadvisory · Maven

GHSA-fvwh-wv43-8qj5 Stored XSS vulnerability in Validating String Parameter Plugin

HIGH Published 2022-05-24 Modified 2022-12-29 Official page ↗
Aliases
CVE-2020-2257
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:validating-string-parameter
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-12-29

Affected packages

• Maven org.jenkins-ci.plugins:validating-string-parameter: < 2.5 → fixed in 2.5

Description

Validating String Parameter Plugin 2.4 and earlier does not escape regular expressions in tooltips. Additionally, Validating String Parameter Plugin 2.4 does not escape parameter names and parameter descriptions. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Validating String Parameter Plugin 2.5 escapes regular expressions in tooltips and parameter names. Parameter descriptions are rendered using the configured markup formatter.

Related

Alias · CVE (1)

  • CVE-2020-2257 Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References