GHSA-hw26-fw67-qxm9

Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2112

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.tools:git-parameter	< 0.9.12	0.9.12

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2112 advisory
https://github.com/jenkinsci/git-parameter-plugin/commit/6fd933c5b1af4ec5dc27edfe2c74931dbff69012 web
https://github.com/jenkinsci/git-parameter-plugin package
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1709 web
http://www.openwall.com/lists/oss-security/2020/02/12/3 web