CVE-2020-2161

CVE-2020-2161 affects Jenkins 2.227 and earlier, and LTS 2.204.5 and earlier. It is a stored XSS cause by improper escaping of node labels shown in the form validation for label expressions on job configuration pages. The underlying issue is the failure to properly sanitize user-supplied node lab...

CVE-2020-2161

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels...

PT-2020-5054 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.227 and earlier Jenkins LTS versions 2.204.5 and earlier Description: The issue arises from the improper escaping of node labels shown in the form validation for label expressions on job configuration pages, resulting in a...

CVE-2020-2161: Improper Neutralization of Input During Web Page Generation

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels...

Stored XSS vulnerability in label expression validation

Users with Agent/Configure permissions can define labels for nodes. These labels can be referenced in job configurations to restrict where a job can be run. In Jenkins 2.227 and earlier, LTS 2.204.5 and earlier, the form validation for label expressions in job configuration forms did not properly...

CSV Injection on node label

Summary CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. An authenticated malicious user can insert a crafted formula in the node label that can be later executed on another system after another user has downloaded and opened the node li...

Important: Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.10 security and bug fix update

Red Hat OpenShift Container Platform release 3.10.66 is now available with updates to packages and images that fix several security, bug, and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...