What is GHSA-fvwh-wv43-8qj5?

GHSA-fvwh-wv43-8qj5 is a security advisory published by GitHub Security Advisories with High severity. Stored XSS vulnerability in Validating String Parameter Plugin

Which CVE IDs does GHSA-fvwh-wv43-8qj5 cover?

GHSA-fvwh-wv43-8qj5 covers the following CVE IDs: CVE-2020-2257. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fvwh-wv43-8qj5?

GHSA-fvwh-wv43-8qj5 has a CVSS v3 base score of 8.0, published by GitHub Security Advisories.

Which products are affected by GHSA-fvwh-wv43-8qj5?

GHSA-fvwh-wv43-8qj5 affects 1 product, including: maven/org.jenkins-ci.plugins:validating-string-parameter:\u003c= 2.4.

GHSA-fvwh-wv43-8qj5HighCVSS 8.0

Stored XSS vulnerability in Validating String Parameter Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 7, 2023

🔗 CVE IDs covered (1)

CVE-2020-2257 →

📋 Description

Validating String Parameter Plugin 2.4 and earlier does not escape regular expressions in tooltips. Additionally, Validating String Parameter Plugin 2.4 does not escape parameter names and parameter descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Validating String Parameter Plugin 2.5 escapes regular expressions in tooltips and parameter names. Parameter descriptions are rendered using the configured markup formatter.

🎯 Affected products1

maven/org.jenkins-ci.plugins:validating-string-parameter:<= 2.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-2257
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1935
http://www.openwall.com/lists/oss-security/2020/09/16/3
https://github.com/jenkinsci/validating-string-parameter-plugin/commit/345a79d830a5fcd824a3c755506a438c78c48117
https://github.com/advisories/GHSA-fvwh-wv43-8qj5