Stored XSS vulnerability in Jenkins Yet Another Build Visualizer Plugin

MEDIUM 5.4CVE-2020-2236 · GHSA-3mwj-7vmq-w43p · Published 12/08/2020 · updated 17/06/2026

In short

CVE-2020-2236 is a MEDIUM (CVSS 5.4) vulnerability affecting com.axis.system.jenkins.plugins.downstream:yet-another-build-visualizer, yet another build visualizer (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.73%, higher than 54.6% of all vulnerabilities.
Fix: update to 1.12 or later.

Package	Affected versions	Patched versions
com.axis.system.jenkins.plugins.downstream:yet-another-build-visualizer Maven	`< 1.12`	`1.12`
yet another build visualizer jenkins	`≤ 1.11`	No fix yet

Description

Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission.

Yet Another Build Visualizer Plugin 1.12 escapes tooltip content.

NVD description

Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission.

References

nvd.nist.gov/vuln/detail/CVE-2020-2236 · ADVISORY
jenkinsci/yet-another-build-visualizer-plugin commit 0e6db61 · WEB
jenkinsci/yet-another-build-visualizer-plugin · PACKAGE
jenkins.io/security/advisory/2020-08-12 · WEB
openwall.com/lists/oss-security/2020/08/12/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2020-2236 is a MEDIUM (CVSS 5.4) vulnerability affecting com.axis.system.jenkins.plugins.downstream:yet-another-build-visualizer, yet another build visualizer (jenkins).

Chance of exploitation in the next 30 days (EPSS): 0.73%, higher than 54.6% of all vulnerabilities.

Fix: update to 1.12 or later.

Package

Affected versions

Patched versions

com.axis.system.jenkins.plugins.downstream:yet-another-build-visualizer

Maven

< 1.12

1.12

yet another build visualizer

jenkins

≤ 1.11

No fix yet

Description

Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission.

Yet Another Build Visualizer Plugin 1.12 escapes tooltip content.

NVD description