What is GHSA-g8pg-qrvm-wgh2?

GHSA-g8pg-qrvm-wgh2 is a security advisory published by GitHub Security Advisories with Medium severity. Improper Neutralization of Input During Web Page Generation in Jenkins

Which CVE IDs does GHSA-g8pg-qrvm-wgh2 cover?

GHSA-g8pg-qrvm-wgh2 covers the following CVE IDs: CVE-2020-2161. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g8pg-qrvm-wgh2?

GHSA-g8pg-qrvm-wgh2 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-g8pg-qrvm-wgh2?

GHSA-g8pg-qrvm-wgh2 affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003c= 2.204.5; maven/org.jenkins-ci.main:jenkins-core:\u003e 2.222.1, \u003c= 2.227.

GHSA-g8pg-qrvm-wgh2MediumCVSS 5.4

Improper Neutralization of Input During Web Page Generation in Jenkins

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 14, 2023

🔗 CVE IDs covered (1)

CVE-2020-2161 →

📋 Description

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:<= 2.204.5
maven/org.jenkins-ci.main:jenkins-core:> 2.222.1, <= 2.227

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-2161
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1781
http://www.openwall.com/lists/oss-security/2020/03/25/2
https://github.com/jenkinsci/jenkins/commit/dbff6fdcf8c4bc00729ace66c33208ae7aa18ac0
https://github.com/advisories/GHSA-g8pg-qrvm-wgh2