Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2020-2111: Jenkins Subversion Plugin can let attackers inject code
CVE-2020-2111 · published 6 years ago
Summary
The Subversion plugin used in Jenkins up to version 2.13.0 fails to properly clean up error messages shown when you enter the repository URL. This flaw could allow a malicious user to store harmful script code that runs in the browsers of anyone who views the page. Update the plugin to a newer version or remove it if you do not need it.
What to do
- Update jenkins-ci org.jenkins-ci.plugins:subversion to version 2.13.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jenkins-ci | org.jenkins-ci.plugins:subversion |
< 2.13.1 Fix: upgrade to 2.13.1
|
| – | jenkins | subversion |
<= 2.13.0 cpe:2.3:a:jenkins:subversion:*:*:*:*:*:jenkins:*:* |
Original advisory text
Subversion Plugin stored XSS vulnerability
Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-2111
- https://github.com/jenkinsci/subversion-plugin/commit/545ca52f6de9af7541621bbea7...
- https://github.com/advisories/GHSA-x3pr-fcgm-wjgc
- http://www.openwall.com/lists/oss-security/2020/02/12/3 Mailing List Third Party Advisory
- https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Feb 2020
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta