Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2020-2229 — Cross-site Scripting in Project Jenkins

CWE-79 — Cross-site Scripting10 documents8 sources
Severity
5.4MEDIUMNVD
EPSS
2.6%
top 14.43%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Jenkins Project JenkinsJenkins
Timeline
PublishedAug 12
Latest updateMay 24

Description

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDjenkins/jenkins2.235.3+1
▶CVEListV5jenkins_project/jenkinsunspecified — 2.251+1

🔴Vulnerability Details

3
OSV
Jenkins Cross-Site Scripting vulnerability in help icons↗2022-05-24
▶
GHSA
Jenkins Cross-Site Scripting vulnerability in help icons↗2022-05-24
▶
CVEList
CVE-2020-2229: Jenkins 2↗2020-08-12
▶

💥Exploits & PoCs

2
Exploit-DB
Jenkins 2.235.3 - 'tooltip' Stored Cross-Site Scripting↗2020-12-11
▶
Exploit-DB
Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting↗2020-05-11
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2020-08-12↗2020-08-12
▶
Red Hat
jenkins: user-specified tooltip values leads to stored cross-site scripting↗2020-08-12
▶

💬Community

2
Bugzilla
CVE-2020-2229 jenkins: user-specified tooltip values leads to stored cross-site scripting↗2020-09-02
▶
Bugzilla
CVE-2020-2229 jenkins: user-specified tooltip values leads to stored cross-site scripting [fedora-31]↗2020-09-02
▶
CVE-2020-2229 — Cross-site Scripting in Project Jenkins | cvebase