CVE-2020-2199
published 2020-06-03CVE-2020-2199: Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
6.19%
93.5th percentile
Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | compact_columns_plugin | — | — |
| jenkins | echarts_api_plugin | — | — |
| jenkins | play_framework_plugin | — | — |
| jenkins | project_inheritance_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | selenium_plugin | — | — |
| jenkins | subversion_partial_release_manager | <= 1.0.1 | — |
| jenkins | subversion_partial_release_manager_plugin | — | — |
| jenkins | swarm_plugin | — | — |
| jenkins_project | jenkins_subversion_partial_release_manager_plugin | unspecified – 1.0.1 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Jenkins
Jenkins Security Advisory 2020-06-03
vendor_jenkins·2020-06-03·CVSS 5.4
CVE-2020-2190 [MEDIUM] Jenkins Security Advisory 2020-06-03
Title: Jenkins Security Advisory 2020-06-03
Jenkins Security Advisory 2020-06-03
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Compact Columns
Plugin
ECharts API
Plugin
Play Framework
Plugin
Project Inheritance
Plugin
Script Security
Plugin
Selenium
Plugin
Subversion Partial Release Manager
P
OSV
XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
osv·2022-05-24
CVE-2020-2199 [MEDIUM] XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation.
This results in a reflected cross-site scripting (XSS) vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure permission.
GHSA
XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
ghsa·2022-05-24
CVE-2020-2199 [MEDIUM] CWE-79 XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation.
This results in a reflected cross-site scripting (XSS) vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure permission.
No detection rules found.
No writeups or analysis indexed.
2020-06-03
Published