CVE-2020-2113

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
5.4MEDIUM
EPSS
0.1%
top 68.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins GIT Parameter PluginJenkins GIT Parameter
Timeline
PublishedFeb 12
Latest updateMay 24

Description

Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_git_parameter_plugin0.9.4 — unspecified+1

🔴Vulnerability Details

3
OSV
Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS)↗2022-05-24
▶
GHSA
Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS)↗2022-05-24
▶
CVEList
CVE-2020-2113: Jenkins Git Parameter Plugin 0↗2020-02-12
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2020-02-12↗2020-02-12
▶
CVE-2020-2113 (MEDIUM CVSS 5.4) | Jenkins Git Parameter Plugin 0.9.11 | cvebase.io