CVE-2020-2231

jenkins: stored XSS vulnerability in 'trigger builds remotely'

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.

CVSS 3.1 · 5.4 Medium EPSS 5.3% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2230

jenkins: stored XSS vulnerability in project naming strategy

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.

CVSS 3.1 · 5.4 Medium EPSS 82.7% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2229

jenkins: user-specified tooltip values leads to stored cross-site scripting

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.

CVSS 3.1 · 5.4 Medium EPSS 6.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2226

jenkins-2-plugins/matrix-auth: Stored XSS vulnerability in Matrix Authorization Strategy Plugin

Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Matrix Authorization Strategy Openshift

CVE-2020-2225

jenkins-2-plugins/matrix-project: Stored XSS vulnerability in multiple axis builds tooltips

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Matrix Project Openshift

CVE-2020-2224

jenkins-2-plugins/matrix-project: Stored XSS vulnerability in single axis builds tooltips

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Matrix Project Openshift

CVE-2020-2223

jenkins: Stored XSS vulnerability in console links

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2222

jenkins: Stored XSS vulnerability in 'keep forever' badge icons

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2221

jenkins: Stored XSS vulnerability in upstream cause

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2220

jenkins: Stored XSS vulnerability in job build time trend

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2190

jenkins-script-security-plugin: cross-site scripting vulnerability due to configure sandboxed scripts

Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift

CVE-2020-2182

jenkins-credentials-binding-plugin: improper masking of secrets

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Credentials Binding Openshift

CVE-2020-2181

jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Credentials Binding Openshift

CVE-2020-2167

openshift/jenkins-plugin: Deserialization in snakeyaml YAML() objects allows for remote code execution

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Openshift Pipeline Openshift

CVE-2020-2163

jenkins: improperly processes HTML content of list leads to XSS

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.

CVSS 3.1 · 5.4 Medium EPSS 1.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2162

jenkins: Content-Security-Policy headers for files uploaded leads to XSS

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

CVSS 3.1 · 5.4 Medium EPSS 1.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2161

jenkins: XSS in job configuration pages

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.

CVSS 3.1 · 5.4 Medium EPSS 1.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2160

jenkins: CSRF protection bypass via crafted URLs

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2020-2136

jenkins-git-plugin: stored cross-site scripting

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Git Openshift

CVE-2020-2135

jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution

Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift