CVE-2020-2224

CWE-79 — Cross-site Scripting (XSS)7 documents7 sources
Severity
5.4MEDIUM
EPSS
0.3%
top 47.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Matrix Project PluginJenkins Matrix Project
Timeline
PublishedJul 15
Latest updateMay 24

Description

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_matrix_project_pluginunspecified — 1.16

🔴Vulnerability Details

3
OSV
Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin↗2022-05-24
▶
GHSA
Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin↗2022-05-24
▶
CVEList
CVE-2020-2224: Jenkins Matrix Project Plugin 1↗2020-07-15
▶

📋Vendor Advisories

2
Red Hat
jenkins-2-plugins/matrix-project: Stored XSS vulnerability in single axis builds tooltips↗2020-07-15
▶
Jenkins
Jenkins Security Advisory 2020-07-15↗2020-07-15
▶

💬Community

1
Bugzilla
CVE-2020-2224 jenkins-2-plugins/matrix-project: Stored XSS vulnerability in single axis builds tooltips↗2020-07-15
▶
CVE-2020-2224 (MEDIUM CVSS 5.4) | Jenkins Matrix Project Plugin 1.16 | cvebase.io