PT-2020-15451 · Jenkins · Jenkins

Pierre Beitz · Published 2020-08-12 · Updated 2024-03-06 · CVE-2020-2230

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.251 and earlier Jenkins LTS versions 2.235.3 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the project naming strategy description is not properly escaped, allowing users with Overall/Manage permission to exploit it. The vulnerability is exploitable when the description is displayed on item creation.

Recommendations For Jenkins versions 2.251 and earlier, update to version 2.252 or later to resolve the issue. For Jenkins LTS versions 2.235.3 and earlier, update to version 2.235.4 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JENKINS-2020-2230

CVE-2020-2230

GHSA-9G4M-FFX6-C29G

RHSA-2020:3808

RHSA-2020:3841

RHSA-2020:4223

Affected Products

Jenkins

References · 10

• 🔥 http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/49237 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-2230 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2230 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9g4m-ffx6-c29g · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2020-2230 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/e49f690939596acbc9a1be64128b2c7eaf91a6db · Note
• http://openwall.com/lists/oss-security/2020/08/12/4 · Note