CVE-2020-2222: XSS
A flaw was found in jenkins in versions prior to 2.244 and versions prior to LTS 2.235.1. Job names in the 'Keep this build forever' badge tooltip are not properly escaped which results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure job names. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure job names.
As job names do not generally support the character set needed for XSS, this is believed to be difficult to exploit in common configurations.
Jenkins 2.245, LTS 2.235.2 escapes the job name in the 'Keep this build forever' badge tooltip.
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure job names.
References:
https://www.jenkins.io/security/advisory/2020-07-15/
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
CVE-2020-2222
What is the severity of CVE-2020-2222?
The severity of CVE-2020-2222 is high with a severity value of 8.
How does CVE-2020-2222 affect Jenkins?
CVE-2020-2222 affects Jenkins versions prior to 2.244 and LTS 2.235.1.
What is the impact of CVE-2020-2222?
CVE-2020-2222 allows stored cross-site scripting (XSS) attacks.
How can I fix CVE-2020-2222?
To fix CVE-2020-2222, update Jenkins to version 2.245 or LTS 2.235.2.1597220898-1.el7.