GHSA-hvmc-7g2x-r3p9

Jenkins Cross-Site Scripting vulnerability in help icons

Source: GitHub Advisory Database (reviewed) High CVE-2020-2229

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	< 2.235.4	2.235.4
Maven	org.jenkins-ci.main:jenkins-core	>= 2.236, < 2.252	2.252

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values. This results in a stored cross-site scripting (XSS) vulnerability. Jenkins 2.252, LTS 2.235.4 escapes the tooltip content of help icons.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2229 advisory
https://github.com/jenkinsci/jenkins/commit/fe4cbe03804d6240d0b58d0b2301ea9530a34916 web
https://github.com/jenkinsci/jenkins package
https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955 web
http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html web
http://www.openwall.com/lists/oss-security/2020/08/12/4 web