GHSA-g8pg-qrvm-wgh2

ghsaUSosv

Improper Neutralization of Input During Web Page Generation in Jenkins

view advisory published 2022-05-24Licence: CC-BY-4.0

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-2161US	medium5.4	1.24% (69th)	—	2020-03-25
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resu…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2020/03/25/2WEB
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1781WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-2161ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan