GHSA-9g4m-ffx6-c29g

Jenkins Cross-site Scripting vulnerability in project naming strategy

Source: GitHub Advisory Database (reviewed) High CVE-2020-2230

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	< 2.235.4	2.235.4
Maven	org.jenkins-ci.main:jenkins-core	>= 2.236, < 2.252	2.252

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, that is displayed on item creation.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.\n\nJenkins 2.252, LTS 2.235.4 escapes the project naming strategy description.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2230 advisory
https://github.com/jenkinsci/jenkins/commit/e49f690939596acbc9a1be64128b2c7eaf91a6db web
https://github.com/jenkinsci/jenkins package
https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957 web
http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html web
http://www.openwall.com/lists/oss-security/2020/08/12/4 web