Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin

MEDIO 5.4CVE-2020-2224 · GHSA-h6qc-455m-7v6v · Published 15/07/2020 · updated 17/06/2026

En resumen

CVE-2020-2224 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a org.jenkins-ci.plugins:matrix-project, matrix project (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.92%, mayor que el 60.2% de las vulnerabilidades.
Solución: actualizar a 1.17 o posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:matrix-project Maven	`< 1.17`	`1.17`
matrix project jenkins	`≤ 1.16`	No fix yet

Description

Matrix Project Plugin 1.16 and earlier does not escape node names shown in tooltips on the overview page of builds with a single axis. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Agent/Configure permission.

Matrix Project Plugin 1.17 escapes the node names shown in these tooltips.

NVD description

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2020-2224 · ADVISORY
jenkinsci/matrix-project-plugin commit b5f22a4 · WEB
jenkinsci/matrix-project-plugin · PACKAGE
jenkins.io/security/advisory/2020-07-15 · WEB
openwall.com/lists/oss-security/2020/07/15/5 · WEB

Más vulnerabilidades de org.jenkins-ci.plugins:matrix-project

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:matrix-project

Maven

< 1.17

1.17

matrix project

jenkins

≤ 1.16

No fix yet

Description

Matrix Project Plugin 1.17 escapes the node names shown in these tooltips.

NVD description

Más vulnerabilidades de org.jenkins-ci.plugins:matrix-project

Ver todo →