VulnerabilityModified
CVE-2020-2217
Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
MEDIUM 6.1EPSS 0.70%
Does this matter?
Lower severity and a low EPSS score (0.70%). Track it; it rarely justifies an emergency change on its own.
Description
Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.70% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- praqma/compatibility action storage
- Source
- jenkinsci-cert@googlegroups.com
References
- http://www.openwall.com/lists/oss-security/2020/07/02/7Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1771Vendor Advisory
- http://www.openwall.com/lists/oss-security/2020/07/02/7Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1771Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.