Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS)

Description

References

• nvd.nist.gov/vuln/detail/CVE-2020-2112 · ADVISORY
• jenkinsci/git-parameter-plugin commit 6fd933c · WEB
• jenkinsci/git-parameter-plugin · PACKAGE
• jenkins.io/security/advisory/2020-02-12 · WEB
• openwall.com/lists/oss-security/2020/02/12/3 · WEB

More vulnerabilities in org.jenkins-ci.tools:git-parameter

• CVE-2026-57286MEDIUM 4.3A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obta…
• CVE-2025-53652HIGH 8.2Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches o…
• CVE-2022-29040MEDIUM 5.4Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, r…
• CVE-2020-2238MEDIUM 5.4Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a sto…
• CVE-2020-2113MEDIUM 5.4Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scriptin…