GHSA-qgj4-rc8m-44mq

Опубликовано: 24 мая 2022

Источник: github

Github: Прошло ревью

CVSS3: 8

Описание

Stored XSS vulnerability in Jenkins job build time trend

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Jenkins 2.245, LTS 2.235.2 escapes the agent name.

Ссылки

Пакеты

Наименование

org.jenkins-ci.main:jenkins-core

maven

Затронутые версииВерсия исправления

<= 2.235.1

2.235.2

Наименование

org.jenkins-ci.main:jenkins-core

maven

Затронутые версииВерсия исправления

>= 2.236, <= 2.244

2.245

EPSS

Процентиль: 61%

0.01023

Низкий

8 High

CVSS3

CVE ID

CVE-2020-2220

Дефекты

CWE-79

Связанные уязвимости

CVE-2020-2220

CVSS3: 8

redhat

около 6 лет назад

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

CVE-2020-2220

CVSS3: 5.4

nvd

около 6 лет назад

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

CVE-2020-2220

CVSS3: 5.4

debian

около 6 лет назад

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the ...

EPSS

Процентиль: 61%

0.01023

Низкий

8 High

CVSS3

CVE ID

CVE-2020-2220

Дефекты

CWE-79