Stored XSS vulnerability in Jenkins Timestamper Plugin

MEDIO 4.8CVE-2020-2137 · GHSA-6xxf-rwv4-mrjm · Published 09/03/2020 · updated 17/06/2026

En resumen

CVE-2020-2137 es una vulnerabilidad MEDIO (CVSS 4.8) que afecta a org.jenkins-ci.plugins:timestamper, timestamper (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.70%, mayor que el 53.4% de las vulnerabilidades.
Solución: actualizar a 1.11.2 o posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:timestamper Maven	`< 1.11.2`	`1.11.2`
timestamper jenkins	`≤ 1.11.1`	No fix yet

Description

Timestamper Plugin 1.11.1 and earlier does not escape or sanitize the HTML formatting used to display the timestamps in console output for builds.

This results in a stored cross-site scripting vulnerability that can be exploited by users with Overall/Administer permission.

Timestamper Plugin 1.11.2 sanitizes the HTML formatting for timestamps and only allows basic, safe HTML formatting.

NVD description

Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.

References

nvd.nist.gov/vuln/detail/CVE-2020-2137 · ADVISORY
jenkinsci/timestamper-plugin commit 6637c3e · WEB
jenkinsci/timestamper-plugin · PACKAGE
jenkins.io/security/advisory/2020-03-09 · WEB
openwall.com/lists/oss-security/2020/03/09/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free