Stored cross-site scripting in Jenkins and Jenkins LTS - CVE-2020-2162

Vulnerability identifier: #VU26392

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2020-2162

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in file parameters. A remote authenticated attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Jenkins
Jenkins LTS
cri-o (Red Hat package)
jenkins (Alpine package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
openshift-ansible (Red Hat package)
machine-config-daemon (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
openshift-kuryr (Red Hat package)
conmon (Red Hat package)
s390utils (Red Hat package)
jenkins (Red Hat package)
Red Hat OpenShift Container Platform

Install update from vendor's website.

Jenkins - update to 2.228
Jenkins LTS - addressed in versions 2.204.6, 2.222.1
cri-o (Red Hat package) - addressed in versions 1.16.6-15.dev.rhaos4.3.gitebc053b.el7, 1.16.6-15.dev.rhaos4.3.gitebc053b.el8, 1.17.4-14.dev.rhaos4.4.gitb93af5d.el7, 1.17.4-14.dev.rhaos4.4.gitb93af5d.el8
jenkins (Alpine package) - update to 2.228-r0
openshift (Red Hat package) - addressed in versions 4.3.25-202006060952.git.1.96c30f6.el7, 4.3.25-202006060952.git.1.96c30f6.el8, 4.4.0-202006061254.git.1.dc84fb4.el7, 4.4.0-202006061254.git.1.dc84fb4.el8
openshift-clients (Red Hat package) - addressed in versions 4.3.25-202006060952.git.1.fd93102.el7, 4.3.25-202006060952.git.1.fd93102.el8, 4.4.0-202006061254.git.1.26cb6dc.el7, 4.4.0-202006061254.git.1.26cb6dc.el8
openshift-ansible (Red Hat package) - addressed in versions 4.3.25-202006060952.git.1.1253fde.el7, 4.4.0-202006061254.git.1.a996454.el7
machine-config-daemon (Red Hat package) - addressed in versions 4.3.25-202006081518.git.1.478b31a.el8, 4.4.0-202006080017.git.1.32e0736.el8
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.3.25-202006081518.git.1.79365c5.el7, 4.4.0-202006080017.git.1.7e463c3.el7
atomic-enterprise-service-catalog (Red Hat package) - addressed in versions 4.3.25-202006081518.git.1.52b3a66.el7, 4.4.0-202006080017.git.1.77a5cc9.el7
openshift-kuryr (Red Hat package) - addressed in versions 4.3.25-202006081518.git.1.240b401.el8, 4.4.0-202006080017.git.1.855ef1d.el8
conmon (Red Hat package) - addressed in versions 2.0.17-1.rhaos4.3.el7, 2.0.17-1.rhaos4.3.el8, 2.0.17-1.rhaos4.4.el7, 2.0.17-1.rhaos4.4.el8
s390utils (Red Hat package) - update to 2.6.0-23.el8
jenkins (Red Hat package) - addressed in versions 2.222.1.1591349991-1.el7, 2.222.1.1591351066-1.el7
Red Hat OpenShift Container Platform - update to 4.4.8

• http://www.openwall.com/lists/oss-security/2020/03/25/2
• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1793

• Multiple vulnerabilities in Jenkins and LTS
• Stored cross-site scripting in jenkins (Alpine package)
• OpenShift Container Platform 4.3.25 packages security update
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.4 packages