CVE-2020-2266: XSS
Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2266?
CVE-2020-2266 has a medium severity rating due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2020-2266?
To fix CVE-2020-2266, update the Jenkins Description Column Plugin to version 1.4 or later.
What type of vulnerability is CVE-2020-2266?
CVE-2020-2266 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2020-2266?
Any Jenkins user with Job/Configure permissions using Description Column Plugin versions 1.3 or earlier is affected by CVE-2020-2266.
What can attackers do with CVE-2020-2266?
Attackers can exploit CVE-2020-2266 to execute malicious scripts on the web browser of users accessing the affected Jenkins instance.