CVE-2020-2230

MEDIUM

Jenkins Cross-site Scripting vulnerability in project naming strategy

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-2230 has a selected CVSS score of 5.4 (medium); EIP currently links 1 catalogued exploit.

Description

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

2
ProductSourceVersion range

Jenkins

Browse Jenkins project / Jenkins
CVE ListThrough 2.251affected
Through LTS 2.235.3affected

org.jenkins-ci.main:jenkins-core

Browse Maven / org.jenkins-ci.main:jenkins-core
GitHub AdvisoryBefore 2.235.4 · Fixed in 2.235.4affected
2.236 to < 2.252 · Fixed in 2.252affected

Proofs of concept

1

Catalogued exploits

ExploitDBJenkins 2.235.3 - 'Description' Stored XSSExploitDB exploitby gx1Not analyzed1 file
ExploitDB
PoC details

References

6