Description

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.

Remediation

References

CVE-2020-2222

Related Vulnerabilities

PostgreSQL Incorrect Ownership Assignment Vulnerability (CVE-2026-6469)

Oracle Database Server CVE-2011-0806 Vulnerability (CVE-2011-0806)

WordPress Plugin Yes/No Chart SQL Injection (1.0.11)

WordPress Plugin WooCommerce-Store Toolkit Privilege Escalation (1.5.7)

WordPress Plugin LearnPress-WordPress LMS Arbitrary File Write (3.2.2)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2020-2222