Jenkins Cross-Site Scripting vulnerability in help icons
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values. This results in a stored cross-site scripting (XSS) vulnerability. Jenkins 2.252, LTS 2.235.4 escapes the tooltip content of help icons.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-2229US | medium5.4 | Exploit | ||
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.htmlWEB
- http://www.openwall.com/lists/oss-security/2020/08/12/4WEB
- https://github.com/jenkinsci/jenkinsPACKAGE
- https://github.com/jenkinsci/jenkins/commit/fe4cbe03804d6240d0b58d0b2301ea9530a34916WEB
- https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-2229ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan