Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-2223)

Description

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.

Remediation

References

CVE-2020-2223

Related Vulnerabilities

WordPress Plugin Helpful Security Bypass (4.5.14)

WordPress Plugin Coming Soon Page & Maintenance Mode Cross-Site Request Forgery (1.7.8)

WordPress Plugin Best Seo Remote Code Execution (1.5)

WordPress Plugin CopySafe PDF Protection Unspecified Vulnerability (1.10)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-38264)

Severity

Medium

Classification

CVE-2020-2223 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N