Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin

MITTEL 5.4CVE-2020-2201 · GHSA-f799-hfg3-48jp · Published 02/07/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-2201 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in org.jenkins-ci.plugins:sonargraph-integration, sonargraph integration (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.73%, höher als bei 54.5% aller Schwachstellen.
Abhilfe: auf 3.0.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:sonargraph-integration Maven	`< 3.0.1`	`3.0.1`
sonargraph integration jenkins	`≤ 3.0.0`	No fix yet

Description

Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation.

This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Job/Configure permission.

Sonargraph Integration Plugin 3.0.1 escapes the affected part of the error message.

NVD description

Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2020-2201 · ADVISORY
jenkinsci/sonargraph-integration-plugin · PACKAGE
jenkins.io/security/advisory/2020-07-02 · WEB
openwall.com/lists/oss-security/2020/07/02/7 · WEB

Weitere Schwachstellen in org.jenkins-ci.plugins:sonargraph-integration

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Kurz gesagt

CVE-2020-2201 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in org.jenkins-ci.plugins:sonargraph-integration, sonargraph integration (jenkins).

Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.73%, höher als bei 54.5% aller Schwachstellen.

Abhilfe: auf 3.0.1 oder neuer aktualisieren.

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:sonargraph-integration

Maven

< 3.0.1

3.0.1

sonargraph integration

jenkins

≤ 3.0.0

No fix yet

Description

Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation.

This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Job/Configure permission.

Sonargraph Integration Plugin 3.0.1 escapes the affected part of the error message.

NVD description

Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability.