CVE-2020-2230 - jenkins: stored XSS vulnerability in project naming strategy

Back Back to CVE browser

MEDIUM

jenkins: stored XSS vulnerability in project naming strategy

Published Aug 12, 2020

5.4

MEDIUM

CVSS 3.1

EPSS 82.73%

Description

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.

Affected products

Vendor Jenkins project Product Jenkins Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.251
- Version
  unspecified
  Status
  affected
  Constraints
  <=LTS 2.235.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins

n/a

Version	Status	Constraints
unspecified	affected	<=2.251
unspecified	affected	<=LTS 2.235.3

Red Hat OpenShift Container Platform 3.11

jenkins-0:2.235.5.1600415953-1.el7

Fixed · RHSA-2020:4223
Red Hat OpenShift Container Platform 4.3

jenkins-0:2.235.5.1600415514-1.el7

Fixed · RHSA-2020:3808
Red Hat OpenShift Container Platform 4.4

openshift4/ose-jenkins:v4.4.0-202009260441.p0

Fixed · RHSA-2020:4220
Red Hat OpenShift Container Platform 4.5

jenkins-0:2.235.5.1600414805-1.el7

Fixed · RHSA-2020:3841
Red Hat Fuse 7

jenkins

Not affected

Product	Package	State	Advisory
Red Hat OpenShift Container Platform 3.11	jenkins-0:2.235.5.1600415953-1.el7	Fixed	RHSA-2020:4223
Red Hat OpenShift Container Platform 4.3	jenkins-0:2.235.5.1600415514-1.el7	Fixed	RHSA-2020:3808
Red Hat OpenShift Container Platform 4.4	openshift4/ose-jenkins:v4.4.0-202009260441.p0	Fixed	RHSA-2020:4220
Red Hat OpenShift Container Platform 4.5	jenkins-0:2.235.5.1600414805-1.el7	Fixed	RHSA-2020:3841
Red Hat Fuse 7	jenkins	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (9)

http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://www.openwall.com/lists/oss-security/2020/08/12/4
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-2230
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1875232
Issue Tracking
https://github.com/advisories/GHSA-9g4m-ffx6-c29g
Advisory
https://github.com/jenkinsci/jenkins/commit/e49f690939596acbc9a1be64128b2c7eaf91a6db
https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2230
https://www.cve.org/CVERecord?id=CVE-2020-2230

Link	Providers	Tags
http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://www.openwall.com/lists/oss-security/2020/08/12/4		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-2230		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1875232		Issue Tracking
https://github.com/advisories/GHSA-9g4m-ffx6-c29g		Advisory
https://github.com/jenkinsci/jenkins/commit/e49f690939596acbc9a1be64128b2c7eaf91a6db
https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2230
https://www.cve.org/CVERecord?id=CVE-2020-2230