Jenkins project · Jenkins Audit Trail Plugin
The Jenkins Audit Trail Plugin (version 3.2 and earlier, from the Jenkins project) contains a flaw where the error message for the URL Patterns field's form validation is not escaped, resulting in a reflected cross-site scripting vulnerability. An attacker could exploit this by getting a user to interact with a crafted link or input that triggers the validation error, causing script to run in the victim's browser.
Disclosed on 9 Mar 2020. No public exploit code or confirmed exploitation is recorded.
3 fixes in audit-trail over 7 months. The latest fix listed for audit-trail is 3.7.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:audit-trail.
Upgrade to 3.3 or later
Set the version to 3.3 or later in your pom.xml or build.gradle.
The first fix for CVE-2020-2140. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 3.3 | 3.3 |
“Up to” means the second version is the fix and is not affected.