CVE-2020-2256: XSS
Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Other sources
Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job’s display name shown as part of a build cause.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Pipeline Maven Integration Plugin 3.9.3 escapes upstream job names in build causes.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for Jenkins Pipeline Maven Integration Plugin?
The vulnerability ID for Jenkins Pipeline Maven Integration Plugin is CVE-2020-2256.
What is the severity of CVE-2020-2256?
The severity of CVE-2020-2256 is medium with a severity value of 5.4.
What is the affected software for CVE-2020-2256?
The affected software for CVE-2020-2256 is Jenkins Pipeline Maven Integration Plugin version up to and including 3.9.2.
What is the description of CVE-2020-2256?
CVE-2020-2256 is a stored cross-site scripting (XSS) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier, allowing attackers with Job/Configure permission to exploit the vulnerability.
Are there any references for CVE-2020-2256?
Yes, you can find references for CVE-2020-2256 at the following links: [reference 1](http://www.openwall.com/lists/oss-security/2020/09/16/3) and [reference 2](https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1976).