QwikSec

Security Database

CVE

CWE

Training

CVE-2020-2244

Published: Sep 1, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.

Vendor	Product	Versions
Jenkins project	Jenkins Build Failure Analyzer Plugin	affected `unspecified - <= 1.27.0`

References

https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1770

x_refsource_CONFIRM

[oss-security] 20200901 Multiple vulnerabilities in Jenkins plugins

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.