Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2020-2140

CWE-79 — Cross-site Scripting (XSS)6 documents6 sources
Severity
6.1MEDIUM
EPSS
44.8%
top 2.42%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Jenkins Project Jenkins Audit Trail PluginJenkins Audit Trail
Timeline
PublishedMar 9
Latest updateMay 24

Description

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_audit_trail_pluginunspecified — 3.2

🔴Vulnerability Details

3
GHSA
XSS vulnerability in Jenkins Audit Trail Plugin↗2022-05-24
▶
OSV
XSS vulnerability in Jenkins Audit Trail Plugin↗2022-05-24
▶
CVEList
CVE-2020-2140: Jenkins Audit Trail Plugin 3↗2020-03-09
▶

💥Exploits & PoCs

1
Nuclei
Jenkin Audit Trail <=3.2 - Cross-Site Scripting
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2020-03-09↗2020-03-09
▶
CVE-2020-2140 (MEDIUM CVSS 6.1) | Jenkins Audit Trail Plugin 3.2 and | cvebase.io