packetstormsecurity.com
http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html CVE-2020-2229
MEDIUM
Jenkins Cross-Site Scripting vulnerability in help icons
Record summary
CVE-2020-2229 has a selected CVSS score of 5.4 (medium); EIP currently links 1 catalogued exploit.
Description
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | Through 2.251 | affected | |
| Through LTS 2.235.3 | affected | ||
org.jenkins-ci.main:jenkins-coreBrowse Maven / org.jenkins-ci.main:jenkins-core | GitHub Advisory | Before 2.235.4 · Fixed in 2.235.4 | affected |
| 2.236 to < 2.252 · Fixed in 2.252 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJenkins 2.235.3 - 'tooltip' Stored Cross-Site ScriptingExploitDB exploitby gx1Not analyzed1 file
References
6[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins pluginsmailing list
http://www.openwall.com/lists/oss-security/2020/08/12/4 github.com
https://github.com/jenkinsci/jenkins github.com
https://github.com/jenkinsci/jenkins/commit/fe4cbe03804d6240d0b58d0b2301ea9530a34916 jenkins.ioConfirmation
https://jenkins.io/security/advisory/2020-08-12 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-2229