Description
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Git Plugin | unspecified – ≤ 4.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.3.1597915133-1.el7 | RHSA-2020:3616, RHSA-2020:2737 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1591354111-1.el7 | RHSA-2020:2478 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | git | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:git | < 4.2.1 | 4.2.1 | GHSA-6c7r-6p5m-cp82 |
Advisories 3
- RHSA-2020:2478 Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:3616 Red Hat Security Advisory: OpenShift Container Platform 4.3.35 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:2737 Red Hat Security Advisory: OpenShift Container Platform 4.4.z jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025