Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:matrix-auth
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2020-2220
CVE-2020-2224
CVE-2020-2226
CWE: CWE-79
CVSS: 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the permission table. This results in a stored cross-site scripting (XSS) vulnerability. When using project-based matrix authorization, this vulnerability can be exploited by a user with Job/Configure or Agent/Configure permission, otherwise by users with Overall/Administer permission. Matrix Authorization Strategy Plugin 2.6.2 escapes user names in the permission table.


Mitigations:

Architectural layers (MAESTRO):