CVE-2020-2244

HIGH8.0EPSS 0.17%

XSS vulnerability in Jenkins Build Failure Analyzer Plugin

Published: 5/24/2022Modified: 2/16/2024

Description

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications. Build Failure Analyzer Plugin 1.27.1 escapes matching text in the affected form validation response.

Affected packages (1)

Maven/com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzerfrom 0, < 1.27.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-2244
PATCHhttps://github.com/jenkinsci/build-failure-analyzer-plugin
WEBhttps://github.com/jenkinsci/build-failure-analyzer-plugin/commit/c974938f213df0109269cb1b4508b8a1ec19f0ff
WEBhttps://jenkins.io/security/advisory/2020-09-01/#SECURITY-1770
WEBhttp://www.openwall.com/lists/oss-security/2020/09/01/3