GitHub Advisoryadvisory · Maven

GHSA-9g4m-ffx6-c29g Jenkins Cross-site Scripting vulnerability in project naming strategy

HIGH Published 2022-05-24 Modified 2022-12-20 Official page ↗
Aliases
CVE-2020-2230
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-06-23

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.235.4 → fixed in 2.235.4 • Maven org.jenkins-ci.main:jenkins-core: >= 2.236, < 2.252 → fixed in 2.252

Description

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, that is displayed on item creation.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.\n\nJenkins 2.252, LTS 2.235.4 escapes the project naming strategy description.

Related

Alias · CVE (1)

  • CVE-2020-2230 Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References