Stored XSS vulnerability in Jenkins Link Column Plugin

MEDIUM 5.4CVE-2020-2219 · GHSA-q2mm-w3qc-2936 · Published 02/07/2020 · updated 17/06/2026

In short

CVE-2020-2219 is a MEDIUM (CVSS 5.4) vulnerability affecting org.jenkins-ci.plugins:link-column, link column (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.73%, higher than 54.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:link-column Maven	`≤ 1.0`	No fix yet
link column jenkins	`≤ 1.0`	No fix yet

Description

Link Column Plugin allows users with View/Configure permission to add a new column to list views that contain a user-configurable link.\n\nLink Column Plugin 1.0 and earlier does not filter the URL for these links, allowing the javascript: scheme. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure list views.

NVD description

Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2020-2219 · ADVISORY
jenkinsci/link-column-plugin · PACKAGE
jenkins.io/security/advisory/2020-07-02 · WEB
openwall.com/lists/oss-security/2020/07/02/7 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free