GHSA-j7q2-c6r4-x2jw

Stored XSS vulnerability in Jenkins Git Parameter Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2020-2238

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.tools:git-parameter	< 0.9.13	0.9.13

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Git Parameter Plugin 0.9.13 escapes the repository field on the 'Build with Parameters' page.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2238 advisory
https://github.com/jenkinsci/git-parameter-plugin/commit/7014c4dd030ee4226b4795137050743a84d67cb0 web
https://github.com/jenkinsci/git-parameter-plugin package
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1884 web
http://www.openwall.com/lists/oss-security/2020/09/01/3 web