GHSA-cj2g-wwfv-mvjh

XSS vulnerability in Jenkins Audit Trail Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2140

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:audit-trail	< 3.3	3.3

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. Audit Trail Plugin 3.3 escapes the affected part of the error message.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2140 advisory
https://github.com/jenkinsci/audit-trail-plugin/commit/40c6d621a03e6a50b291dca7188d07d0aa3de946 web
https://github.com/jenkinsci/audit-trail-plugin package
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1722 web
http://www.openwall.com/lists/oss-security/2020/03/09/1 web