Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nZmhqLTUyNHEtZ2Nybc4AAlYZ

Stored XSS vulnerability in Jenkins console links

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the href attribute of links to downstream jobs displayed in the build console page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission.

Jenkins 2.245, LTS 2.235.2 escapes the href attribute of these links.

Permalink: https://github.com/advisories/GHSA-gfhj-524q-gcrm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nZmhqLTUyNHEtZ2Nybc4AAlYZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 4 months ago

CVSS Score: 8.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-gfhj-524q-gcrm, CVE-2020-2223
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-2223
• https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1945
• http://www.openwall.com/lists/oss-security/2020/07/15/5
• https://github.com/jenkinsci/jenkins/commit/11f4a351224ef04cfeb9c7636fb1590b67543f3c
• https://github.com/advisories/GHSA-gfhj-524q-gcrm

Repository: https://github.com/jenkinsci/jenkins
Blast Radius: 1.0

Affected Packages