CVE-2020-2222 – Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the jo

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the ‘Keep this build forever’ badge tooltip, resulting in a stored cross-site scripting vulnerability.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2222

Reference (s):

• https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1902
• URL: https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1902
• MLIST:[oss-security] 20200715 Multiple vulnerabilities in Jenkins and Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/07/15/5