vulnerability

Jenkins Advisory 2020-07-15: CVE-2020-2223: Stored XSS vulnerability in console links

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:S/C:N/I:P/A:N)

Published

Jul 15, 2020

Added

Dec 2, 2021

Modified

Mar 27, 2026

Description

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.

Solutions

jenkins-lts-upgrade-2_235_2jenkins-upgrade-2_245

References

CVE-2020-2223
https://attackerkb.com/topics/CVE-2020-2223
CWE-79
EUVD-EUVD-2022-3945
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3945
https://jenkins.io/security/advisory/2020-07-15/

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report