Stored XSS vulnerability in Jenkins Timestamper Plugin

MITTEL 4.8CVE-2020-2137 · GHSA-6xxf-rwv4-mrjm · Published 09/03/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-2137 ist eine Schwachstelle (MITTEL (CVSS 4.8)) in org.jenkins-ci.plugins:timestamper, timestamper (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.70%, höher als bei 53.4% aller Schwachstellen.
Abhilfe: auf 1.11.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:timestamper Maven	`< 1.11.2`	`1.11.2`
timestamper jenkins	`≤ 1.11.1`	No fix yet

Description

Timestamper Plugin 1.11.1 and earlier does not escape or sanitize the HTML formatting used to display the timestamps in console output for builds.

This results in a stored cross-site scripting vulnerability that can be exploited by users with Overall/Administer permission.

Timestamper Plugin 1.11.2 sanitizes the HTML formatting for timestamps and only allows basic, safe HTML formatting.

NVD description

Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.

References

nvd.nist.gov/vuln/detail/CVE-2020-2137 · ADVISORY
jenkinsci/timestamper-plugin commit 6637c3e · WEB
jenkinsci/timestamper-plugin · PACKAGE
jenkins.io/security/advisory/2020-03-09 · WEB
openwall.com/lists/oss-security/2020/03/09/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:timestamper

Maven

< 1.11.2

1.11.2

timestamper

jenkins

≤ 1.11.1

No fix yet

Description

Timestamper Plugin 1.11.1 and earlier does not escape or sanitize the HTML formatting used to display the timestamps in console output for builds.

This results in a stored cross-site scripting vulnerability that can be exploited by users with Overall/Administer permission.

Timestamper Plugin 1.11.2 sanitizes the HTML formatting for timestamps and only allows basic, safe HTML formatting.

NVD description

Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.