https://bugzilla.redhat.com/show_bug.cgi?id=1875232
Bug ID: 1875232
Summary: CVE-2020-2230 jenkins: stored XSS vulnerability in
project naming strategy
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: msiddiqu(a)redhat.com
CC: abenaiss(a)redhat.com, aileenc(a)redhat.com,
aos-bugs(a)redhat.com, bmontgom(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jwon(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Blocks: 1874833
Target Milestone: ---
Classification: Other
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project
naming strategy description that is displayed on item creation. This results in
a stored cross-site scripting (XSS) vulnerability exploitable by users with
Overall/Manage permission.
--
You are receiving this mail because:
You are on the CC list for the bug.