Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin

MEDIO 5.4CVE-2020-2225 · GHSA-w43x-5f8f-686p · Published 15/07/2020 · updated 17/06/2026

En resumen

CVE-2020-2225 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a org.jenkins-ci.plugins:matrix-project, matrix project (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.0%, mayor que el 64.0% de las vulnerabilidades.
Solución: actualizar a 1.17 o posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:matrix-project Maven	`< 1.17`	`1.17`
matrix project jenkins	`≤ 1.16`	No fix yet

Description

Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission.

Matrix Project Plugin 1.17 escapes the axis names shown in these tooltips.

NVD description

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2020-2225 · ADVISORY
jenkinsci/matrix-project-plugin commit b5f22a4 · WEB
jenkinsci/matrix-project-plugin · PACKAGE
jenkins.io/security/advisory/2020-07-15 · WEB
openwall.com/lists/oss-security/2020/07/15/5 · WEB

Más vulnerabilidades de org.jenkins-ci.plugins:matrix-project

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:matrix-project

Maven

< 1.17

1.17

matrix project

jenkins

≤ 1.16

No fix yet

Description

Matrix Project Plugin 1.17 escapes the axis names shown in these tooltips.

NVD description

Más vulnerabilidades de org.jenkins-ci.plugins:matrix-project

Ver todo →