CVE-2020-2244

published 2020-09-01

CVE-2020-2244: Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS)…

Priority P4 23 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
jenkins	build_failure_analyzer	<= 1.27.0	—
jenkins	build_failure_analyzer_plugin	—	—
jenkins	cadence_vmanager_plugin	—	—
jenkins	database_plugin	—	—
jenkins	git_parameter_plugin	—	—
jenkins	jsgames_plugin	—	—
jenkins	klocwork_analysis_plugin	—	—
jenkins	klocwork_plugin	—	—
jenkins	parameterized_remote_trigger_plugin	—	—
jenkins	readyapi_functional_testing_plugin	—	—
jenkins	valgrind_plugin	—	—
jenkins_project	jenkins_build_failure_analyzer_plugin	unspecified – 1.27.0	—

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79