GitHub Advisoryadvisory · Maven

GHSA-hvmc-7g2x-r3p9 Jenkins Cross-Site Scripting vulnerability in help icons

HIGH Published 2022-05-24 Modified 2023-12-22 Official page ↗
Aliases
CVE-2020-2229
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-06-23

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.235.4 → fixed in 2.235.4 • Maven org.jenkins-ci.main:jenkins-core: >= 2.236, < 2.252 → fixed in 2.252

Description

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values. This results in a stored cross-site scripting (XSS) vulnerability. Jenkins 2.252, LTS 2.235.4 escapes the tooltip content of help icons.

Related

Alias · CVE (1)

  • CVE-2020-2229 Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References