Stored cross-site scripting in Jenkins LTS and Jenkins - CVE-2020-2229

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the tooltip content of help icons. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Affected software

How to mitigate CVE-2020-2229

Links to Public Exploits and PoC-codes

• Exploit #5633 - Jenkins 2.235.3 - 'tooltip' Stored Cross-Site Scripting (June 17, 2021)

External References

• http://www.openwall.com/lists/oss-security/2020/08/12/4
• https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955

Related Security Bulletins

• Multiple vulnerabilities in Jenkins and Jenkins LTS
• Red Hat OpenShift Container Platform 4.5 update for jenkins
• Red Hat OpenShift Container Platform 3.11 update for jenkins