CVE-2020-2256

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 53.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Pipeline Maven Integration PluginJenkins Pipeline Maven Integration
Timeline
PublishedSep 16
Latest updateMay 24

Description

Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

🔴Vulnerability Details

3
OSV
Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name↗2022-05-24
▶
GHSA
Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name↗2022-05-24
▶
CVEList
CVE-2020-2256: Jenkins Pipeline Maven Integration Plugin 3↗2020-09-16
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2020-09-16↗2020-09-16
▶