CloudBees Jenkins Matrix Project Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Matrix Project Plugin is used in one of the...

Vulnerabilities fixed in Jenkins

Several vulnerabilities have been fixed in Jenkins. A malicious user could potentially exploit the vulnerabilities to perform a Cross-Site Scripting XSS attack. A such an attack can lead to the execution of arbitrary script code in the browser used to visit the application. Jenkins developers hav...

CVE-2020-2225

A flaw was found in the Matrix Project Plugin version 1.16 and prior. Node names shown in tooltips are not escaped on the overview page of builds with multiple axes which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure permission for this...

CVE-2020-2224

A flaw was found in the Matrix Project Plugin version 1.16 and prior. Node names shown in tooltips are not escaped on the overview page of builds with a single axis which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure permission for this...

CVE-2020-2224

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2225

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2225

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability...

Cross site scripting

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2225

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2225

Vulnerability summary (CVE-2020-2225) : The Jenkins Matrix Project Plugin (versions 1.16 and earlier) does not escape axis names in tooltips on the overview page for builds with multiple axes, enabling a stored XSS vulnerability. Exploitation requires user permissions to configure jobs. The issue...

CVE-2020-2224

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2224

The CVE-2020-2224 issue affects Jenkins Matrix Project Plugin (versions 1.16 and earlier). The root cause is failure to escape node names shown in tooltips on the overview page for builds with a single axis, enabling stored cross-site scripting. Impact is user-visible XSS for users with Agent/Con...

CVE-2020-2224

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2225: Improper Neutralization of Input During Web Page Generation

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2224: Improper Neutralization of Input During Web Page Generation

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability...

PT-2020-15440 · Jenkins · Jenkins Matrix Project Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Matrix Project Plugin versions 1.16 and earlier Description: The issue is related to a stored cross-site scripting vulnerability. It occurs because the node names shown in tooltips on the overview page of builds with a single axis are...

Jenkins Matrix Project Code Execution

The vulnerability of the pom.xml components and FilterScript.java src/main/java/hudson/matrix/FilterScript.java of the Matrix Project plugin is related to errors in processing input data during syntax analysis of the code. Exploiting this vulnerability can allow a malicious actor to exit the...

Sandbox Protection Bypass

Jenkins Matrix Project Plugin is vulnerable to sandbox protection bypass vulnerability. This exists in the src/main/java/hudson/matrix/FilterScript.java which allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM...

CVE-2019-1003031

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM...

CVE-2019-1003031

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM...