CVE-2020-2227 – Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL

Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2227

Reference (s):

• https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1915
• URL: https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1915
• MLIST:[oss-security] 20200715 Multiple vulnerabilities in Jenkins and Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/07/15/5