BIT-jenkins-2020-2161

vendorUSosv

view advisory published 2024-03-06Licence: per source

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-2161US	medium5.4	1.24% (69th)	—	2020-03-25
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resu…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2020/03/25/2ADVISORY
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1781ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-2161WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan