cbcvebase.
CVE-2020-2230
published 2020-08-12

CVE-2020-2230: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS)…

PriorityP352medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EXPLOIT
EPSS
83.05%
99.6th percentile
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.

Affected

11 ranges
VendorProductVersion rangeFixed in
jenkinsemail_extension_plugin
jenkinsflaky_test_handler_plugin
jenkinsids_in_pipeline_maven_integration_plugin
jenkinsjenkins<= 2.235.3
jenkinsjenkins<= 2.251
jenkinsjenkins_core
jenkinsjenkins_lts
jenkinsjenkins_weekly
jenkinspipeline_maven_integration_plugin
jenkinsyet_another_build_visualizer_plugin
jenkins_projectjenkinsunspecified – 2.251

Detection & IOCsextracted from sources · hover to see the quote

url/configure
url//jenkins/view/all/newJob
  • Stored XSS payload injected into the 'Description' field of the Project Naming Strategy configuration; payload is triggered when a user enters a non-compliant project name in the New Item creation page.
  • Monitor POST requests to Jenkins /configure endpoint that set a Project Naming Strategy description containing HTML/JavaScript special characters (e.g., <, >, script tags) by users with Overall/Manage permission.
  • XSS fires on the New Item page (newJob) when any character is typed into the name field, if a malicious description is already stored in the Project Naming Strategy.
  • ·Vulnerability only exploitable by users who hold Overall/Manage permission in Jenkins; lower-privileged users cannot set the Project Naming Strategy description.
  • ·Affected versions are Jenkins 2.251 and earlier (weekly) and LTS 2.235.3 and earlier; fixed in Jenkins 2.252 and LTS 2.235.4.
  • ·Red Hat Fuse 7 package 'jenkins' is listed as Not Affected for this CVE.

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_redhat5.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.