CVE-2020-2175

2020-04-0713:15:00

Google

osv.dev

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the XML input files processed by the plugin.

CPENameOperatorVersion
fitnesse-plugineqfitnesse-1.31
fitnesse-plugineqfitnesse-1.30
fitnesse-plugineqfitnesse-1.11
fitnesse-plugineqfitnesse-1.25
fitnesse-plugineqfitnesse-1.14
fitnesse-plugineqfitnesse-1.27
fitnesse-plugineqfitnesse-1.12
fitnesse-plugineqfitnesse-1.6
fitnesse-plugineqfitnesse-1.15
fitnesse-plugineqfitnesse-1.10

Name	Operator	Version
fitnesse-plugin	eq	fitnesse-1.31
fitnesse-plugin	eq	fitnesse-1.30
fitnesse-plugin	eq	fitnesse-1.11
fitnesse-plugin	eq	fitnesse-1.25
fitnesse-plugin	eq	fitnesse-1.14
fitnesse-plugin	eq	fitnesse-1.27
fitnesse-plugin	eq	fitnesse-1.12
fitnesse-plugin	eq	fitnesse-1.6
fitnesse-plugin	eq	fitnesse-1.15
fitnesse-plugin	eq	fitnesse-1.10