{"id":"CVE-2020-2230","published":"2020-08-12T13:25:21Z","modified":"2024-08-04T07:01:41Z","title":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting…","vendor":"Jenkins project","product":"Jenkins","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins","versions":[">= unspecified, <= 2.251",">= unspecified, <= LTS 2.235.3"]}],"description":{"text":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.","provenance":"source","from":"CVE.org"},"summary":{"text":"Jenkins (the Jenkins project's automation server) does not escape the project naming strategy description, creating a stored cross-site scripting flaw in the web interface. An attacker who holds the Overall/Manage permission can store malicious script that executes in the browsers of other users viewing that description.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:36Z"},"cvss":null,"epss":{"score":0.82733,"percentile":0.99667,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2020/08/12/4","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":["<2.235.4",">=2.236, <2.252"],"patched":["2.235.4","2.252"],"from":["GHSA-9g4m-ffx6-c29g"],"provenance":"source"}],"advisories":[{"id":"GHSA-9g4m-ffx6-c29g","url":"https://github.com/advisories/GHSA-9g4m-ffx6-c29g","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":["<2.235.4"],"patched":["2.235.4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-9g4m-ffx6-c29g","url":"https://github.com/advisories/GHSA-9g4m-ffx6-c29g","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":[">=2.236, <2.252"],"patched":["2.252"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-3371","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3371","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":49237,"url":"https://www.exploit-db.com/exploits/49237","title":"Jenkins 2.235.3 - 'Description' Stored XSS","type":"webapps","platform":"java","date":"2020-12-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-12-11"},"first":{"date":"2020-12-11","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/49237"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html"],"flow":[],"timeline":[{"date":"2020-08-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-2230","provenance":"source"},{"date":"2020-12-11","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-49237)","url":"https://www.exploit-db.com/exploits/49237","provenance":"source"}],"speed":{"daysToPublicExploit":121,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9967"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}