Not rated

CVE-2020-2271 Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a…

Description

Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Locked Files Report Plugin 1.6	earliest → 1.6	No fix stated

Do you use Jenkins Locked Files Report Plugin?

Track this CVE Watch Jenkins Locked Files Report Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2020-2271

Timeline

Published September 16, 2020
Last modified August 4, 2024

References

www.jenkins.io www.jenkins.io
[oss-security] 20200916 Multiple vulnerabilities in Jenkins plugins www.openwall.com

Track this CVE