CVE-2020-2162

Improper Neutralization of Input During Web Page Generation in Jenkins

5.4 MediumFix available

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.16%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 5.4

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

Record: CVE-2020-2162
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

Record: CVE-2020-2162
Updated: 2026-11-02

EUVDEUVD-2022-3626 No score

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

Record: EUVD-2022-3626
Updated: 2026-11-03

GitHub AdvisoriesGHSA-crg2-6xv3-qg5f 5.4

Improper Neutralization of Input During Web Page Generation in Jenkins

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier served files uploaded as file parameters to a build without specifying appropriate Content-Security-Policy HTTP headers. This resulted in a stored cross-site scripting (XSS) vulnerability exploitable by users with permissions to build a job with file parameters.\n\nJenkins now sets Content-Security-Policy HTTP headers when serving files uploaded via a file parameter to the same value as used for files in workspaces and archived artifacts not served using the Resource Root URL.\n\nThe system property hudson.model.DirectoryBrowserSupport.CSP can be set to override the value of Content-Security-Policy headers sent when serving these files. This is the same system property used for files in workspaces and archived artifacts unless those are served via the Resource Root URL and works the same way for file parameters. See Configuring Content Security Policy to learn more.\n\nEven when Jenkins is configured to serve files in workspaces and archived artifacts using the Resource Root URL (introduced in Jenkins 2.200), file parameters are not, and therefore still subject to Content-Security-Policy restrictions.

Record: GHSA-crg2-6xv3-qg5f
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVALPINE-CVE-2020-2162 5.4

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

Record: ALPINE-CVE-2020-2162
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

OSV 5.4

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

Record: CVE-2020-2162
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Show 5 moreShow less

OSVGHSA-crg2-6xv3-qg5f 5.4

Improper Neutralization of Input During Web Page Generation in Jenkins

Record: GHSA-crg2-6xv3-qg5f
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVRHBA-2020:2435 8.8

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.25 packages update

Record: RHBA-2020:2435
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHBA-2020:2444 8.8

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.8 packages update

Record: RHBA-2020:2444
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHBA-2020:2477 8.8

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update

Record: RHBA-2020:2477
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBIT-jenkins-2020-2162 No score

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

Record: BIT-jenkins-2020-2162
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	through 2.204.5	2.228
`org.jenkins-ci.main:jenkins-core` Maven	2.204.6 to 2.227	2.228
`jenkins` Alpine:v3.11	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.12	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.13	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.14	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.15	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.16	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.17	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.18	before 2.228-r0	2.228-r0

Show 90 moreShow less

Affected packages
Package	Affected	Fixed
`jenkins` Alpine:v3.19	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.20	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.21	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.22	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.23	before 2.228-r0	2.228-r0
`jenkins` Alpine:v3.24	before 2.228-r0	2.228-r0
`jenkins` Bitnami	before 2.227.1	2.227.1
`org.jenkins-ci.main:jenkins-core` Maven	before 2.228, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437	2.228
`org.jenkins-ci.main:jenkins-core` Maven	2.204.6 up to 2.228, plus listed versions 2.2052.2062.2072.2082.209 Show 21 moreShow less 2.2102.2112.2122.2132.2142.2152.2162.2172.2182.2192.2202.2212.2222.222.12.222.32.222.42.2232.2242.2252.2262.227	2.228
`atomic-enterprise-service-catalog` Red Hat:openshift:4.3::el7	before 1:4.3.25-202006081518.git.1.52b3a66.el7	1:4.3.25-202006081518.git.1.52b3a66.el7
`atomic-enterprise-service-catalog-svcat` Red Hat:openshift:4.3::el7	before 1:4.3.25-202006081518.git.1.52b3a66.el7	1:4.3.25-202006081518.git.1.52b3a66.el7
`atomic-openshift-service-idler` Red Hat:openshift:4.3::el7	before 0:4.3.25-202006081518.git.1.79365c5.el7	0:4.3.25-202006081518.git.1.79365c5.el7
`conmon` Red Hat:openshift:4.3::el7	before 2:2.0.17-1.rhaos4.3.el7	2:2.0.17-1.rhaos4.3.el7
`cri-o` Red Hat:openshift:4.3::el7	before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7	0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7
`cri-o-debuginfo` Red Hat:openshift:4.3::el7	before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7	0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7
`jenkins` Red Hat:openshift:4.3::el7	before 0:2.222.1.1591349991-1.el7	0:2.222.1.1591349991-1.el7
`openshift` Red Hat:openshift:4.3::el7	before 0:4.3.25-202006060952.git.1.96c30f6.el7	0:4.3.25-202006060952.git.1.96c30f6.el7
`openshift-ansible` Red Hat:openshift:4.3::el7	before 0:4.3.25-202006060952.git.1.1253fde.el7	0:4.3.25-202006060952.git.1.1253fde.el7
`openshift-ansible-test` Red Hat:openshift:4.3::el7	before 0:4.3.25-202006060952.git.1.1253fde.el7	0:4.3.25-202006060952.git.1.1253fde.el7
`openshift-clients` Red Hat:openshift:4.3::el7	before 0:4.3.25-202006060952.git.1.fd93102.el7	0:4.3.25-202006060952.git.1.fd93102.el7
`openshift-clients-redistributable` Red Hat:openshift:4.3::el7	before 0:4.3.25-202006060952.git.1.fd93102.el7	0:4.3.25-202006060952.git.1.fd93102.el7
`openshift-hyperkube` Red Hat:openshift:4.3::el7	before 0:4.3.25-202006060952.git.1.96c30f6.el7	0:4.3.25-202006060952.git.1.96c30f6.el7
`conmon` Red Hat:openshift:4.3::el8	before 2:2.0.17-1.rhaos4.3.el8	2:2.0.17-1.rhaos4.3.el8
`cri-o` Red Hat:openshift:4.3::el8	before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8	0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8
`cri-o-debuginfo` Red Hat:openshift:4.3::el8	before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8	0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8
`cri-o-debugsource` Red Hat:openshift:4.3::el8	before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8	0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8
`machine-config-daemon` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006081518.git.1.478b31a.el8	0:4.3.25-202006081518.git.1.478b31a.el8
`openshift` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006060952.git.1.96c30f6.el8	0:4.3.25-202006060952.git.1.96c30f6.el8
`openshift-clients` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006060952.git.1.fd93102.el8	0:4.3.25-202006060952.git.1.fd93102.el8
`openshift-clients-redistributable` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006060952.git.1.fd93102.el8	0:4.3.25-202006060952.git.1.fd93102.el8
`openshift-hyperkube` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006060952.git.1.96c30f6.el8	0:4.3.25-202006060952.git.1.96c30f6.el8
`openshift-kuryr` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006081518.git.1.240b401.el8	0:4.3.25-202006081518.git.1.240b401.el8
`openshift-kuryr-cni` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006081518.git.1.240b401.el8	0:4.3.25-202006081518.git.1.240b401.el8
`openshift-kuryr-common` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006081518.git.1.240b401.el8	0:4.3.25-202006081518.git.1.240b401.el8
`openshift-kuryr-controller` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006081518.git.1.240b401.el8	0:4.3.25-202006081518.git.1.240b401.el8
`python3-kuryr-kubernetes` Red Hat:openshift:4.3::el8	before 0:4.3.25-202006081518.git.1.240b401.el8	0:4.3.25-202006081518.git.1.240b401.el8
`s390utils` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-base` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-base-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-cmsfs` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-cmsfs-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-cmsfs-fuse` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-cmsfs-fuse-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-cpacfstatsd` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-cpacfstatsd-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-cpuplugd` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-cpuplugd-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-debugsource` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-devel` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-hmcdrvfs` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-hmcdrvfs-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-iucvterm` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-iucvterm-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-mon_statd` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-mon_statd-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-osasnmpd` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-osasnmpd-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-zdsfs` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-zdsfs-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-ziomon` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`s390utils-ziomon-debuginfo` Red Hat:openshift:4.3::el8	before 2:2.6.0-23.el8	2:2.6.0-23.el8
`atomic-enterprise-service-catalog` Red Hat:openshift:4.4::el7	before 1:4.4.0-202006080017.git.1.77a5cc9.el7	1:4.4.0-202006080017.git.1.77a5cc9.el7
`atomic-enterprise-service-catalog-svcat` Red Hat:openshift:4.4::el7	before 1:4.4.0-202006080017.git.1.77a5cc9.el7	1:4.4.0-202006080017.git.1.77a5cc9.el7
`atomic-openshift-service-idler` Red Hat:openshift:4.4::el7	before 0:4.4.0-202006080017.git.1.7e463c3.el7	0:4.4.0-202006080017.git.1.7e463c3.el7
`conmon` Red Hat:openshift:4.4::el7	before 2:2.0.17-1.rhaos4.4.el7	2:2.0.17-1.rhaos4.4.el7
`cri-o` Red Hat:openshift:4.4::el7	before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7	0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7
`cri-o-debuginfo` Red Hat:openshift:4.4::el7	before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7	0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7
`jenkins` Red Hat:openshift:4.4::el7	before 0:2.222.1.1591351066-1.el7	0:2.222.1.1591351066-1.el7
`openshift` Red Hat:openshift:4.4::el7	before 0:4.4.0-202006061254.git.1.dc84fb4.el7	0:4.4.0-202006061254.git.1.dc84fb4.el7
`openshift-ansible` Red Hat:openshift:4.4::el7	before 0:4.4.0-202006061254.git.1.a996454.el7	0:4.4.0-202006061254.git.1.a996454.el7
`openshift-ansible-test` Red Hat:openshift:4.4::el7	before 0:4.4.0-202006061254.git.1.a996454.el7	0:4.4.0-202006061254.git.1.a996454.el7
`openshift-clients` Red Hat:openshift:4.4::el7	before 0:4.4.0-202006061254.git.1.26cb6dc.el7	0:4.4.0-202006061254.git.1.26cb6dc.el7
`openshift-clients-redistributable` Red Hat:openshift:4.4::el7	before 0:4.4.0-202006061254.git.1.26cb6dc.el7	0:4.4.0-202006061254.git.1.26cb6dc.el7
`openshift-hyperkube` Red Hat:openshift:4.4::el7	before 0:4.4.0-202006061254.git.1.dc84fb4.el7	0:4.4.0-202006061254.git.1.dc84fb4.el7
`conmon` Red Hat:openshift:4.4::el8	before 2:2.0.17-1.rhaos4.4.el8	2:2.0.17-1.rhaos4.4.el8
`cri-o` Red Hat:openshift:4.4::el8	before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8	0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8
`cri-o-debuginfo` Red Hat:openshift:4.4::el8	before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8	0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8
`cri-o-debugsource` Red Hat:openshift:4.4::el8	before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8	0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8
`machine-config-daemon` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006080017.git.1.32e0736.el8	0:4.4.0-202006080017.git.1.32e0736.el8
`openshift` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006061254.git.1.dc84fb4.el8	0:4.4.0-202006061254.git.1.dc84fb4.el8
`openshift-clients` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006061254.git.1.26cb6dc.el8	0:4.4.0-202006061254.git.1.26cb6dc.el8
`openshift-clients-redistributable` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006061254.git.1.26cb6dc.el8	0:4.4.0-202006061254.git.1.26cb6dc.el8
`openshift-hyperkube` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006061254.git.1.dc84fb4.el8	0:4.4.0-202006061254.git.1.dc84fb4.el8
`openshift-kuryr` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006080017.git.1.855ef1d.el8	0:4.4.0-202006080017.git.1.855ef1d.el8
`openshift-kuryr-cni` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006080017.git.1.855ef1d.el8	0:4.4.0-202006080017.git.1.855ef1d.el8
`openshift-kuryr-common` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006080017.git.1.855ef1d.el8	0:4.4.0-202006080017.git.1.855ef1d.el8
`openshift-kuryr-controller` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006080017.git.1.855ef1d.el8	0:4.4.0-202006080017.git.1.855ef1d.el8
`python3-kuryr-kubernetes` Red Hat:openshift:4.4::el8	before 0:4.4.0-202006080017.git.1.855ef1d.el8	0:4.4.0-202006080017.git.1.855ef1d.el8
`jenkins` Red Hat:openshift:3.11::el7	before 0:2.222.1.1591351669-1.el7	0:2.222.1.1591351669-1.el7

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-2162 is a medium vulnerability (CVSS 5.4) in Jenkins, published March 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.228.

References

Show 40 moreShow less

This page doesn't list everything

Left out here: 561 versions. The JSON record has them.