VulnerabilityModified
CVE-2020-2152
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
MEDIUM 6.1EPSS 1.27%
Does this matter?
Lower severity and a low EPSS score (1.27%). Track it; it rarely justifies an emergency change on its own.
Description
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.27% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- jenkins/subversion release manager
- Source
- jenkinsci-cert@googlegroups.com
References
- http://www.openwall.com/lists/oss-security/2020/03/09/1Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1727Vendor Advisory
- http://www.openwall.com/lists/oss-security/2020/03/09/1Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1727Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.