CVE-2020-2264 – Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job de

Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2264

Reference (s):

• https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1914
• URL: https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1914
• MLIST:[oss-security] 20200916 Multiple vulnerabilities in Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/09/16/3