PT-2020-15438 · Cloudbees+1 · Jenkins

Wadeck Follonier · Published 2020-07-15 · Updated 2024-03-06 · CVE-2020-2222

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.244 and earlier Jenkins LTS versions 2.235.1 and earlier

Description The issue results from the job name in the 'Keep this build forever' badge tooltip not being escaped, leading to a stored cross-site scripting vulnerability. This vulnerability is exploitable by users who can configure job names. However, it is believed to be difficult to exploit in common configurations due to the limited character set supported by job names.

Recommendations For Jenkins versions 2.244 and earlier, update to version 2.245 or later to resolve the issue. For Jenkins LTS versions 2.235.1 and earlier, update to version 2.235.2 or later to resolve the issue. As a temporary workaround, consider restricting the ability to configure job names to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JENKINS-2020-2222

CVE-2020-2222

GHSA-864V-5Q2G-FR64

RHSA-2020:3519

RHSA-2020:3541

RHSA-2020:3808

Affected Products

Jenkins

References · 9

• https://osv.dev/vulnerability/GHSA-864v-5q2g-fr64 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1902 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2222 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2020-2222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2222 · Security Note
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/e7443ef2ef255253231f3f1db0034fae39f0cba5 · Note
• https://t.me/cvenotify/5048 · Telegram Post
• http://openwall.com/lists/oss-security/2020/07/15/5 · Note