CVE-2020-2152 Jenkins Subversion Release Manager Plugin vulnerable to cross-site scripting (XSS)
MediumCVSS 6.1
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jvnet.hudson.plugins/svn-release-mgr(Maven) | <= 1.2 | No fix listed |
| org.jvnet.hudson.plugins/svn-release-mgr(Maven) | = 0.1 | No fix listed |
| org.jvnet.hudson.plugins/svn-release-mgr(Maven) | = 0.2 | No fix listed |
| org.jvnet.hudson.plugins/svn-release-mgr(Maven) | = 1.0 | No fix listed |
| org.jvnet.hudson.plugins/svn-release-mgr(Maven) | = 1.1 | No fix listed |
| org.jvnet.hudson.plugins/svn-release-mgr(Maven) | = 1.2 | No fix listed |
| jenkins subversion release manager | <= 1.2 | No fix listed |
| Jenkins Project Jenkins Subversion Release Manager Plugin | <= 1.2 | No fix listed |
| Jenkins Project Jenkins Subversion Release Manager Plugin | >= next of 1.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- jenkins.io vendor-advisory
- [oss-security] 20200309 Multiple vulnerabilities in Jenkins plugins mailing-list third-party-advisory
- github.com
- github.com product