CVE-2020-2169
Reflected XSS vulnerability in Jenkins Queue cleanup Plugin
A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.
- Record
CVE-2020-2169- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.
- Record
CVE-2020-2169- Updated
- 2026-11-02
EUVDEUVD-2022-4512 No score
A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.
- Record
EUVD-2022-4512- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m7pr-m4cx-6m22
Reflected XSS vulnerability in Jenkins Queue cleanup Plugin
A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability (XSS).
Queue cleanup Plugin 1.4 correctly escapes the query parameter.
- Record
GHSA-m7pr-m4cx-6m22- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.
- Record
CVE-2020-2169- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-m7pr-m4cx-6m22
Reflected XSS vulnerability in Jenkins Queue cleanup Plugin
A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability (XSS).
Queue cleanup Plugin 1.4 correctly escapes the query parameter.
- Record
GHSA-m7pr-m4cx-6m22- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:queue-cleanupMaven |
before 1.4 | 1.4 |
org.jenkins-ci.plugins:queue-cleanupMaven |
before 1.4, plus listed versions 1.01.11.21.3 |
1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2169 is a medium vulnerability (CVSS 6.1) in Jenkins Queue Cleanup, published March 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile. Fixed in org.jenkins-ci.plugins:queue-cleanup 1.4.
References
jenkins.io/security/advisory/2020-03-25
openwall.com/lists/oss-security/2020/03/25/2
nvd.nist.gov/vuln/detail/CVE-2020-2169
github.com/jenkinsci/queue-cleanup-plugin/commit/b3e562a427e704fc15dafe7664bd67aafcd4e03e