CVE-2020-2244: XSS
Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for Jenkins Build Failure Analyzer Plugin?
The vulnerability ID for Jenkins Build Failure Analyzer Plugin is CVE-2020-2244.
What is the severity of CVE-2020-2244?
The severity of CVE-2020-2244 is medium with a CVSS score of 5.4.
How does CVE-2020-2244 affect Jenkins Build Failure Analyzer Plugin?
CVE-2020-2244 affects Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier versions.
What is the impact of CVE-2020-2244?
CVE-2020-2244 allows attackers to exploit a cross-site scripting (XSS) vulnerability by providing console output for builds used to test build log indications.
Is there a fix for CVE-2020-2244?
Yes, it is recommended to update Jenkins Build Failure Analyzer Plugin to version 1.27.1 or later to fix CVE-2020-2244.