Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jZnZ3LTg0dnEtNDNteM4AAlX_

Stored XSS vulnerability in Jenkins Deployer Framework Plugin

Deployer Framework Plugin is a framework plugin allowing other plugins to provide a way to deploy artifacts. Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to provide the location.

The exploitability of this vulnerability depends on the specific implementation using Deployer Framework Plugin. The Jenkins security team is not aware of any exploitable implementation.

Deployer Framework Plugin 1.3 escapes the URL.

Permalink: https://github.com/advisories/GHSA-cfvw-84vq-43mx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jZnZ3LTg0dnEtNDNteM4AAlX_
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 5 months ago

CVSS Score: 8.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-cfvw-84vq-43mx, CVE-2020-2227
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-2227
• https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1915
• http://www.openwall.com/lists/oss-security/2020/07/15/5
• https://github.com/jenkinsci/deployer-framework-plugin/commit/8fa2e16bce85ec1b93be60102d7cfb5153876e83
• https://github.com/advisories/GHSA-cfvw-84vq-43mx

Repository: https://github.com/jenkinsci/deployer-framework-plugin
Blast Radius: 1.0

Affected Packages