CVE-2020-2243

2020-09-0114:15:12

Google

osv.dev

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.

CPENameOperatorVersion
vmanager-plugineqmanager-plugin-2.5.8
vmanager-plugineqmanager-plugin-2.1
vmanager-plugineqmanager-plugin-2.0
vmanager-plugineqmanager-plugin-1.2
vmanager-plugineqmanager-plugin-2.5.2
vmanager-plugineqmanager-plugin-2.5.6
vmanager-plugineqmanager-plugin-2.5.9
vmanager-plugineqmanager-plugin-2.4.7
vmanager-plugineqmanager-plugin-2.7.1
vmanager-plugineqmanager-plugin-3.0.1

Name	Operator	Version
vmanager-plugin	eq	manager-plugin-2.5.8
vmanager-plugin	eq	manager-plugin-2.1
vmanager-plugin	eq	manager-plugin-2.0
vmanager-plugin	eq	manager-plugin-1.2
vmanager-plugin	eq	manager-plugin-2.5.2
vmanager-plugin	eq	manager-plugin-2.5.6
vmanager-plugin	eq	manager-plugin-2.5.9
vmanager-plugin	eq	manager-plugin-2.4.7
vmanager-plugin	eq	manager-plugin-2.7.1
vmanager-plugin	eq	manager-plugin-3.0.1