CVE-2020-2230 Public exploit EPSS 82.7%

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting…

Summary

Jenkins (the Jenkins project's automation server) does not escape the project naming strategy description, creating a stored cross-site scripting flaw in the web interface. An attacker who holds the Overall/Manage permission can store malicious script that executes in the browsers of other users viewing that description.

Official description · CVE.org

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.

Breakdown

24.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) appeared 4 months after disclosure. No confirmed exploitation is recorded.

Disclosed12 Aug 2020day 0
Public exploit codeExploit-DB11 Dec 2020+4 mo

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.main:jenkins-core.

Mavenorg.jenkins-ci.main:jenkins-coreGHSA-9g4m-ffx6-c29g

Upgrade to 2.555.3 or later

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2024-23897, CVE-2024-23898, +2).

Set the version to 2.555.3 or later in your pom.xml or build.gradle.

First fixed in 2.252 for CVE-2020-2230.

Affected versions, by release line

If you run	Upgrade to
2.236 up to 2.252	2.555.3first fix for this CVE: 2.252
All versions before 2.235.4 Still affected on this line by CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2024-23898 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).	2.235.4

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-3371

Jenkins 2.235.3 - 'Description' Stored XSSEDB-49237 · webapps · java · 2020-12-11

, 30 Oct 2026

82.7%Top 0.33%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.67%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9967 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 Exploit-DB entry; 1 NVD exploit link 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total24.9

Record

Published: 12 Aug 2020
Modified: 4 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

x_refsource_CONFIRM 1

mailing-list 1

x_refsource_MISC 1

techniques