CVE-2020-2122

2020-02-1215:15:13

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability exploitable by users able to control the Brakeman post-build step input data.

CPENameOperatorVersion
brakeman-plugineqbrakeman-0.8
brakeman-plugineqbrakeman-0.9
brakeman-plugineqbrakeman-0.6
brakeman-plugineqbrakeman-0.10
brakeman-plugineqbrakeman-0.7
brakeman-plugineqbrakeman-0.11
brakeman-plugineqbrakeman-0.4
brakeman-plugineqbrakeman-0.5
brakeman-plugineqbrakeman-0.12

Name	Operator	Version
brakeman-plugin	eq	brakeman-0.8
brakeman-plugin	eq	brakeman-0.9
brakeman-plugin	eq	brakeman-0.6
brakeman-plugin	eq	brakeman-0.10
brakeman-plugin	eq	brakeman-0.7
brakeman-plugin	eq	brakeman-0.11
brakeman-plugin	eq	brakeman-0.4
brakeman-plugin	eq	brakeman-0.5
brakeman-plugin	eq	brakeman-0.12