XSS vulnerability in Jenkins Audit Trail Plugin

MEDIUM 6.1CVE-2020-2140 · GHSA-cj2g-wwfv-mvjh · Published 09/03/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:audit-trail Maven	`< 3.3`	`3.3`
audit trail jenkins	`≤ 3.2`	No fix yet

Description

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. Audit Trail Plugin 3.3 escapes the affected part of the error message.

NVD description

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2020-2140 · ADVISORY
jenkinsci/audit-trail-plugin commit 40c6d62 · WEB
jenkinsci/audit-trail-plugin · PACKAGE
jenkins.io/security/advisory/2020-03-09 · WEB
openwall.com/lists/oss-security/2020/03/09/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free