QwikSec

Security Database

CVE

CWE

Training

CVE-2020-2231

Published: Aug 12, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.

Vendor	Product	Versions
Jenkins project	Jenkins	affected `unspecified - <= 2.251` affected `unspecified - <= LTS 2.235.3`

References

https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1960

x_refsource_CONFIRM

[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins

mailing-list

x_refsource_MLIST

http://packetstormsecurity.com/files/160616/Jenkins-2.251-LTS-2.235.3-Cross-Site-Scripting.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.