PT-2020-5054 · Cloudbees+1 · Jenkins

Wadeck Follonier · Published 2020-03-25 · Updated 2024-03-06 · CVE-2020-2161

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.227 and earlier Jenkins LTS versions 2.204.5 and earlier

Description The issue arises from the improper escaping of node labels shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability. This vulnerability can be exploited by users who have the ability to define node labels, potentially allowing remote attackers to perform cross-site scripting attacks.

Recommendations For Jenkins versions 2.227 and earlier, update to a version that properly escapes node labels to prevent stored XSS vulnerabilities. For Jenkins LTS versions 2.204.5 and earlier, update to a version that properly escapes node labels to prevent stored XSS vulnerabilities. As a temporary workaround, consider restricting the ability to define node labels to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-05641

BIT-JENKINS-2020-2161

CVE-2020-2161

GHSA-G8PG-QRVM-WGH2

Affected Products

Jenkins

References · 8

• https://osv.dev/vulnerability/BIT-jenkins-2020-2161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2161 · Security Note
• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1781 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2161 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g8pg-qrvm-wgh2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05641 · Security Note
• http://openwall.com/lists/oss-security/2020/03/25/2 · Note
• https://t.me/cvenotify/2136 · Telegram Post