Patchfirst
Patchfirst
CVE-2020-2140 Public exploit EPSS 76.0%

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.

Jenkins project · Jenkins Audit Trail Plugin

Summary

The Jenkins Audit Trail Plugin (version 3.2 and earlier, from the Jenkins project) contains a flaw where the error message for the URL Patterns field's form validation is not escaped, resulting in a reflected cross-site scripting vulnerability. An attacker could exploit this by getting a user to interact with a crafted link or input that triggers the validation error, causing script to run in the victim's browser.

Heading is the official description · CVE.org
Breakdown
24.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 9 Mar 2020. No public exploit code or confirmed exploitation is recorded.

2 related vulnerabilities in the same code over 7 months. The latest fix listed for audit-trail is 3.7.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2020-2140Jenkins Audit Trail Plugin 3.2 and earlier does not escape the…9 Mar 2020
  2. relatedHigh

    Why these are linked:

    • Fixed one release later3.3 → 3.7 (org.jenkins-ci.plugins:audit-trail)
    • Same code patched: AuditTrailPlugin.java (machine-matched)Functions: doRegexCheckcommit 40c6d62commit 4343314
    • Similar weakness in the same product (machine-matched)same product + description similarity
    CVE-2020-2288In Jenkins Audit Trail Plugin 3.6 and earlier, the default…8 Oct 2020

Fixes in audit-trailMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 3.3CVE-2020-21409 Mar 2020
  2. 3.7CVE-2020-22878 Oct 2020
  3. 3.7CVE-2020-22888 Oct 2020Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:audit-trail.

Mavenorg.jenkins-ci.plugins:audit-trailGHSA-cj2g-wwfv-mvjh

Upgrade to 3.3 or later

Set the version to 3.3 or later in your pom.xml or build.gradle.

The first fix for CVE-2020-2140. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
All versions before 3.33.3

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_CONFIRM 1

jenkins.io/security/advisory/2020-03-09/#SECURITY-1722

mailing-list 1

openwall.com/lists/oss-security/2020/03/09/1
↑ ↓ chooseEnter openEsc close