Description

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.

Remediation

References

CVE-2020-2161

Related Vulnerabilities

WordPress Plugin All in One SEO-Best WordPress SEO-Easily Improve SEO Rankings & Increase Traffic Cross-Site Scripting (2.3.6.1)

Plone CMS Cryptographic Issues Vulnerability (CVE-2012-6661)

WordPress Plugin Catch Themes Demo Import Unspecified Vulnerability (1.8)

Envoy Proxy Origin Validation Error Vulnerability (CVE-2020-15104)

WordPress 3.9.x Cross-Site Scripting Vulnerability (3.9 - 3.9.9)

Severity

Medium

Classification

CVE-2020-2161 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities