CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2020-2161
Medium (5.4) in jenkins jenkins. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.228.
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g8pg-qrvm-wgh2 | Maven | org.jenkins-ci.main:jenkins-core | <2.228 | 2.228 |
| GHSA-g8pg-qrvm-wgh2 | Maven | org.jenkins-ci.main:jenkins-core | >=2.204.6 <2.228 | 2.228 |