GHSA-jpvq-v729-7j2h

Improper Neutralization of Input During Web Page Generation in Jenkins

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2231

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	< 2.235.4	2.235.4
Maven	org.jenkins-ci.main:jenkins-core	>= 2.237, < 2.252	2.252

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2231 advisory
https://github.com/jenkinsci/jenkins/commit/29c9a8fdeafe26fded955cfba188f50fd4f1786a web
https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1960 web
http://packetstormsecurity.com/files/160616/Jenkins-2.251-LTS-2.235.3-Cross-Site-Scripting.html web
http://www.openwall.com/lists/oss-security/2020/08/12/4 web