CVE-2020-2225

CWE-79 — Cross-site Scripting (XSS)7 documents7 sources
Severity
5.4MEDIUM
EPSS
0.3%
top 46.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Matrix Project PluginJenkins Matrix Project
Timeline
PublishedJul 15
Latest updateMay 24

Description

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_matrix_project_pluginunspecified — 1.16

🔴Vulnerability Details

3
OSV
Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin↗2022-05-24
▶
GHSA
Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin↗2022-05-24
▶
CVEList
CVE-2020-2225: Jenkins Matrix Project Plugin 1↗2020-07-15
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2020-07-15↗2020-07-15
▶
Red Hat
jenkins-2-plugins/matrix-project: Stored XSS vulnerability in multiple axis builds tooltips↗2020-07-15
▶

💬Community

1
Bugzilla
CVE-2020-2225 jenkins-2-plugins/matrix-project: Stored XSS vulnerability in multiple axis builds tooltips↗2020-07-15
▶
CVE-2020-2225 (MEDIUM CVSS 5.4) | Jenkins Matrix Project Plugin 1.16 | cvebase.io