PT-2020-15439 · Cloudbees+1 · Jenkins

Oleg Nenashev · Published 2020-07-15 · Updated 2024-03-06 · CVE-2020-2223

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.244 and earlier Jenkins LTS versions 2.235.1 and earlier

Description The issue results from incorrect escaping of the href attribute of links to downstream jobs displayed in the build console page, leading to a stored cross-site scripting vulnerability. This vulnerability is exploitable by users with Job/Configure permission.

Recommendations For Jenkins versions 2.244 and earlier, update to version 2.245 or later to resolve the issue. For Jenkins LTS versions 2.235.1 and earlier, update to version 2.235.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the build console page for users with Job/Configure permission until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JENKINS-2020-2223

CVE-2020-2223

GHSA-GFHJ-524Q-GCRM

RHSA-2020:3519

RHSA-2020:3541

RHSA-2020:3808

Affected Products

Jenkins

References · 9

• https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2223 · Security Note
• https://osv.dev/vulnerability/GHSA-gfhj-524q-gcrm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2223 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2020-2223 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/11f4a351224ef04cfeb9c7636fb1590b67543f3c · Note
• https://t.me/cvenotify/5049 · Telegram Post
• http://openwall.com/lists/oss-security/2020/07/15/5 · Note