CVE-2020-2174

Vulnerability

Jenkins AWSEB Deployment Plugin 0.3.19 and earlier fails to escape various values printed as part of form validation output [1][2]. This missing output encoding allows injection of arbitrary HTML and JavaScript into the plugin's validation responses.

Exploitation

An attacker can craft a malicious URL or form input that triggers a validation endpoint, causing the injected script to execute in the context of a victim's browser session [2]. The attack is reflected and requires user interaction, such as clicking on a crafted link, but does not require authentication to Jenkins [2].

Impact

Successful exploitation enables arbitrary JavaScript execution in the victim's browser, potentially leading to session hijacking, credential theft, or performing actions on behalf of the victim [2]. The vulnerability is classified as medium severity with a CVSS score of 6.1 [1].

Mitigation

The vulnerability is fixed in AWSEB Deployment Plugin version 0.3.20, which properly escapes values printed in form validation output [2][3]. Users should upgrade immediately. No workarounds are available beyond updating the plugin.