high8.0Public exploit code
CVE-2020-2229
Jenkins Cross-Site Scripting vulnerability in help icons
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Jenkins 2.235.3 - 'tooltip' Stored Cross-Site Scripting2020-12-11 · webapps · java
Impact
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values. This results in a stored cross-site scripting (XSS) vulnerability. Jenkins 2.252, LTS 2.235.4 escapes the tooltip content of help icons.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | <= 2.235.3 | 2.235.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | through 2.235.3 through 2.251 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html
- http://www.openwall.com/lists/oss-security/2020/08/12/4
- https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955
- https://github.com/advisories/GHSA-hvmc-7g2x-r3p9
- https://nvd.nist.gov/vuln/detail/CVE-2020-2229
- https://github.com/jenkinsci/jenkins/commit/fe4cbe03804d6240d0b58d0b2301ea9530a34916