GHSA-gfhj-524q-gcrmHighCVSS 8.0

Stored XSS vulnerability in Jenkins console links

Published
May 24, 2022
Last Modified
December 14, 2023

🔗 CVE IDs covered (1)

CVE-2020-2223 →

📋 Description

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the href attribute of links to downstream jobs displayed in the build console page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission.

Jenkins 2.245, LTS 2.235.2 escapes the href attribute of these links.

🎯 Affected products2

  • maven/org.jenkins-ci.main:jenkins-core:<= 2.235.1
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.236, <= 2.244

🔗 References (5)