CVE-2020-2231: XSS
A flaw was found in Jenkins versions prior to 2.251 and LTS 2.235.3. The remote address of hosts starting a build via 'Trigger builds remotely' are not properly escaped leading to a potential stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the authentication token. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely'. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2231?
CVE-2020-2231 has a medium severity rating and poses a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2020-2231?
To fix CVE-2020-2231, upgrade to Jenkins version 2.252 or LTS version 2.235.4 or later.
Who is affected by CVE-2020-2231?
CVE-2020-2231 affects Jenkins versions prior to 2.251 and LTS version 2.235.3.
What are the consequences of exploiting CVE-2020-2231?
Exploitation of CVE-2020-2231 can allow unauthorized users with Job/Configure permissions to execute arbitrary JavaScript in the context of the web application.
Is CVE-2020-2231 easy to exploit?
CVE-2020-2231 can be exploited by users with certain permissions, making it a risk if proper access controls are not in place.