CVE-2020-2230: XSS
A flaw was found in Jenkins in versions prior to 2.251 and LTS 2.235.3. The project naming strategy description, displayed on item creation, is not properly escaped. This can result in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permissions. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description that is displayed on item creation. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
— Red Hat
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, that is displayed on item creation.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.\n\nJenkins 2.252, LTS 2.235.4 escapes the project naming strategy description.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2230?
CVE-2020-2230 is classified as a medium severity stored cross-site scripting vulnerability.
Who is affected by CVE-2020-2230?
CVE-2020-2230 affects Jenkins versions prior to 2.251 and LTS 2.235.3.
How do I fix CVE-2020-2230?
To fix CVE-2020-2230, upgrade Jenkins to version 2.252 or later, or LTS version 2.235.4 or later.
What can attackers do with CVE-2020-2230?
Attackers with Overall/Manage permissions can exploit CVE-2020-2230 to execute malicious scripts in users' browsers.
Is CVE-2020-2230 related to cross-site scripting vulnerabilities?
Yes, CVE-2020-2230 is specifically a stored cross-site scripting (XSS) vulnerability.