GHSA-qgj4-rc8m-44mqHighCVSS 8.0

Stored XSS vulnerability in Jenkins job build time trend

Published
May 24, 2022
Last Modified
December 7, 2023

🔗 CVE IDs covered (1)

CVE-2020-2220 →

📋 Description

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Jenkins 2.245, LTS 2.235.2 escapes the agent name.

🎯 Affected products2

  • maven/org.jenkins-ci.main:jenkins-core:<= 2.235.1
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.236, <= 2.244

🔗 References (5)