VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 8, 2020· Updated Aug 4, 2024

CVE-2020-2292

CVE-2020-2292

Description

Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Release/Release permission.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins Release Plugin 2.10.2 and earlier has a stored XSS vulnerability via unescaped release version in badge tooltip.

Vulnerability

Description

Jenkins Release Plugin 2.10.2 and earlier does not escape the release version when it is displayed in a badge tooltip on build pages. This flaw allows an attacker to inject malicious HTML or JavaScript code into the tooltip, leading to stored cross-site scripting (XSS) [1][2].

Exploitation

Prerequisites

An attacker must have at least Release/Release permission in Jenkins to exploit this vulnerability. By crafting a release version string containing JavaScript, the attacker can store the payload on the Jenkins server. When other users (including administrators) hover over the badge, the injected script executes in their browser context [1][2].

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the victim's Jenkins session. This can lead to theft of session cookies, modification of job configurations, credential extraction, or other actions that the victim user can perform [1][2].

Mitigation

Jenkins plugin maintainers have acknowledged the issue and provided a fix in commit 99814a0, which escapes the release version before rendering it in the tooltip [4]. Users are advised to update to a patched version once available or apply the fix manually [3]. The vulnerability has been assigned CVE-2020-2292 with a CVSS v3.1 base score of 6.5 (Medium) [2].

References
  1. Jenkins Security Advisory 2020-10-08
  2. NVD - CVE-2020-2292
  3. security - Multiple vulnerabilities in Jenkins plugins
  4. SECURITY-1928 Fix stored xss (#33) · jenkinsci/release-plugin@99814a0

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:releaseMaven
< 2.112.11

Affected products

3

Patches

1
99814a0c82f5

SECURITY-1928 Fix stored xss (#33)

https://github.com/jenkinsci/release-pluginTim JacombDec 18, 2020via ghsa
commit
1 file changed · +1 −1
  • src/main/java/hudson/plugins/release/ReleaseWrapper.java+1 −1 modified
    @@ -737,7 +737,7 @@ public ReleaseBuildBadgeAction() {
         }
         
         public String getReleaseVersion() {
-            return releaseVersion;
+            return releaseVersion != null ? Util.xmlEscape(releaseVersion) : null;
         }
         
         public String getIconFileName() { return null; }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

1