Description

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.

Remediation

References

CVE-2020-2231

Related Vulnerabilities

Drupal Core 4.7.x Cross-Site Request Forgery (4.7.0 - 4.7.3)

Apache Tomcat Improper Input Validation Vulnerability (CVE-2013-4286)

Dolibarr Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2017-9840)

WordPress Plugin Redirection Cross-Site Request Forgery (1.1.3)

Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2020-9757)

Severity

Medium

Classification

CVE-2020-2231 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities