GHSA-vr6v-wjfw-rxcr

Source

https://github.com/advisories/GHSA-vr6v-wjfw-rxcr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vr6v-wjfw-rxcr/GHSA-vr6v-wjfw-rxcr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vr6v-wjfw-rxcr

Aliases

CVE-2020-2226

Published

2022-05-24T17:23:39Z

Modified

2024-02-16T08:08:04.967602Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin

Details

Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the permission table. This results in a stored cross-site scripting (XSS) vulnerability. When using project-based matrix authorization, this vulnerability can be exploited by a user with Job/Configure or Agent/Configure permission, otherwise by users with Overall/Administer permission.

Matrix Authorization Strategy Plugin 2.6.2 escapes user names in the permission table.

Database specific

{
    "nvd_published_at": "2020-07-15T18:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-23T23:18:38Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:matrix-auth

Package

Name: org.jenkins-ci.plugins:matrix-auth; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/matrix-auth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.2

Affected versions

1.*

1.0

1.0.1

1.0.2

1.1

1.2

1.3

1.3.1

1.3.2

1.4

1.5

1.6

1.7

2.*

2.0-beta-1

2.0-beta-2

2.0-beta-3

2.0

2.1

2.1.1

2.2

2.3

2.4

2.4.1

2.4.2

2.5

2.5.1

2.5.2

2.6

2.6.1

Database specific

{
    "last_known_affected_version_range": "<= 2.6.1"
}