CVE-2020-2229: XSS
A flaw was found in Jenkins in versions prior to 2.251 and LTS 2.235.3. Tooltip values, which are not properly escaped, can be contributed by plugins and use user-specified values. This results in a potential stored cross-site scripting (XSS) vulnerability. This highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values. This results in a stored cross-site scripting (XSS) vulnerability. Jenkins 2.252, LTS 2.235.4 escapes the tooltip content of help icons.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-2229?
CVE-2020-2229 is a vulnerability found in Jenkins that allows for a stored cross-site scripting (XSS) attack.
What is the severity of CVE-2020-2229?
The severity of CVE-2020-2229 is medium, with a CVSS score of 5.4.
How does CVE-2020-2229 affect Jenkins?
CVE-2020-2229 affects Jenkins versions prior to 2.251 and LTS 2.235.3.
How can I fix CVE-2020-2229?
To fix CVE-2020-2229, update Jenkins to version 2.252 or higher, or LTS 2.235.4 or higher.
Where can I find more information about CVE-2020-2229?
More information about CVE-2020-2229 can be found at the following references: [Link 1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1874831), [Link 2](https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955), [Link 3](https://access.redhat.com/errata/RHSA-2020:3841)