GHSA-x3pr-fcgm-wjgc

Subversion Plugin stored XSS vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2111

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:subversion	< 2.13.1	2.13.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability. Subversion Plugin 2.13.1 escapes the affected part of the error message.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2111 advisory
https://github.com/jenkinsci/subversion-plugin/commit/545ca52f6de9af7541621bbea716ead449cd2b98 web
https://github.com/jenkinsci/subversion-plugin package
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725 web
http://www.openwall.com/lists/oss-security/2020/02/12/3 web