GHSA-HQ2H-9MC3-H6W2 Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name

🗓️ 24 May 2022 17:28:25Reported by GoogleType

osv🔗 osv.dev👁 25 Views

Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name. Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job’s display name shown as part of a build cause. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Pipeline Maven Integration Plugin 3.9.3 escapes upstream job names in build causes

Reporter	Title	Published	Views	Family All 11
AlpineLinux	CVE-2020-2256	16 Sep 202013:20	–	alpinelinux
CNVD	CloudBees Jenkins Pipeline Maven Integration Cross Site Scripting Vulnerability	17 Sep 202000:00	–	cnvd
CVE	CVE-2020-2256	16 Sep 202013:20	–	cve
Cvelist	CVE-2020-2256	16 Sep 202013:20	–	cvelist
EUVD	EUVD-2022-4191	3 Oct 202520:07	–	euvd
Github Security Blog	Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name	24 May 202217:28	–	github
NVD	CVE-2020-2256	16 Sep 202014:15	–	nvd
Prion	Cross site scripting	16 Sep 202014:15	–	prion
Positive Technologies	PT-2020-15481 · Jenkins · Jenkins Pipeline Maven Integration Plugin +1	16 Sep 202000:00	–	ptsecurity
RedhatCVE	CVE-2020-2256	22 May 202516:13	–	redhatcve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-2256
github	www.github.com/jenkinsci/pipeline-maven-plugin/commit/78b8e6d49bffcc6b65064a882c03a2b4bb157230
github	www.github.com/jenkinsci/pipeline-maven-plugin
jenkins	www.jenkins.io/security/advisory/2020-09-16/
openwall	www.openwall.com/lists/oss-security/2020/09/16/3

21 Feb 2024 05:32Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.18

EPSS0.00735