GHSA-m7pr-m4cx-6m22

Reflected XSS vulnerability in Jenkins Queue cleanup Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2169

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:queue-cleanup	< 1.4	1.4

Details

As written in the advisory (Markdown source, shown as plain text).

A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability (XSS). Queue cleanup Plugin 1.4 correctly escapes the query parameter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2169 advisory
https://github.com/jenkinsci/queue-cleanup-plugin/commit/b3e562a427e704fc15dafe7664bd67aafcd4e03e web
https://github.com/jenkinsci/queue-cleanup-plugin/commit/e7dae99aa3a414004e953303c7c687d65348de11 web
https://github.com/jenkinsci/queue-cleanup-plugin package
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724 web
http://www.openwall.com/lists/oss-security/2020/03/25/2 web