GHSA-g4j6-m3m3-crw8HighCVSS 8.0

Stored XSS vulnerability in Jenkins upstream cause

Published
May 24, 2022
Last Modified
December 22, 2023

🔗 CVE IDs covered (1)

CVE-2020-2221 →

📋 Description

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.

Jenkins 2.245, LTS 2.235.2 escapes the job display name.

🎯 Affected products2

  • maven/org.jenkins-ci.main:jenkins-core:<= 2.235.1
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.236, <= 2.244

🔗 References (5)