CVE-2020-2161

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami jenkins

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.227.1"}]}]

参照URL

advisory openwall.com
advisory jenkins.io
web nvd.nist.gov