Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-2263

CVE-2020-2263: Stored XSS vulnerability in Radiator View Plugin

8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-2263
GHSA ID
GHSA-7vp5-xf5q-fxjq
EPSS Score
0.46137%
CWE
CWE-79
Published
5/24/2022
Updated
1/28/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:radiatorviewpluginmaven<= 1.29

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unescaped job names in tooltips. Jenkins plugins typically use Jelly templates for HTML rendering. The Radiator View's index.jelly would contain the logic to display job names in tooltips. Since the advisory explicitly mentions the full name isn't escaped, the most probable location is the template directly outputting ${job.fullName} without using Jenkins' escapeHtml() function or Jelly's built-in escaping mechanisms. This matches Jenkins XSS vulnerability patterns where user-controlled data (job names) is rendered without proper context-aware escaping.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins R**i*tor Vi*w Plu*in *.** *n* **rli*r *o*s not *s**p* t** *ull n*m* o* t** jo*s in tooltips, r*sultin* in * stor** *ross-sit* s*riptin* (XSS) vuln*r**ility *xploit**l* *y *tt**k*rs wit* Jo*/*on*i*ur* p*rmission.

Reasoning

T** vuln*r**ility st*ms *rom un*s**p** jo* n*m*s in tooltips. J*nkins plu*ins typi**lly us* J*lly t*mpl*t*s *or *TML r*n**rin*. T** R**i*tor Vi*w's `in**x.j*lly` woul* *ont*in t** lo*i* to *ispl*y jo* n*m*s in tooltips. Sin** t** **visory *xpli*itly