[org.jvnet.hudson.plugins:svn-release-mgr] Jenkins Subversion Release Manager Plugin vulnerable to cross-site scripting (XSS)

Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation. This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure permission.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-2152
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1727
• http://www.openwall.com/lists/oss-security/2020/03/09/1
• https://github.com/advisories/GHSA-wc2g-9j98-vcgw