GitHub Advisoryadvisory · Maven

GHSA-864v-5q2g-fr64 Stored XSS vulnerability in Jenkins 'keep forever' badge icon

HIGH Published 2022-05-24 Modified 2022-12-27 Official page ↗
Aliases
CVE-2020-2222
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-06-24

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.235.2 → fixed in 2.235.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.236, < 2.245 → fixed in 2.245

Description

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure job names. As job names do not generally support the character set needed for XSS, this is believed to be difficult to exploit in common configurations. Jenkins 2.245, LTS 2.235.2 escapes the job name in the 'Keep this build forever' badge tooltip.

Related

Alias · CVE (1)

  • CVE-2020-2222 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References