CVE-2020-2220

Stored XSS vulnerability in Jenkins job build time trend

5.4 MediumFix available

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.02%Up 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 5.4

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Record: CVE-2020-2220
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Record: CVE-2020-2220
Updated: 2026-11-02

EUVDEUVD-2022-4968 No score

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Record: EUVD-2022-4968
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qgj4-rc8m-44mq 8.0

Stored XSS vulnerability in Jenkins job build time trend

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Jenkins 2.245, LTS 2.235.2 escapes the agent name.

Record: GHSA-qgj4-rc8m-44mq
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

OSVALPINE-CVE-2020-2220 5.4

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Record: ALPINE-CVE-2020-2220
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

OSV 5.4

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Record: CVE-2020-2220
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Show 7 moreShow less

OSVGHSA-qgj4-rc8m-44mq 8.0

Stored XSS vulnerability in Jenkins job build time trend

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Jenkins 2.245, LTS 2.235.2 escapes the agent name.

Record: GHSA-qgj4-rc8m-44mq
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

OSVRHBA-2020:3441 8.0

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.18 packages update

Record: RHBA-2020:3441
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:3519 8.0

Red Hat Security Advisory: OpenShift Container Platform 4.5.7 jenkins and openshift packages security update

Record: RHSA-2020:3519
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:3541 8.0

Red Hat Security Advisory: OpenShift Container Platform 3.11 security update

Record: RHSA-2020:3541
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:3579 8.0

Red Hat Security Advisory: OpenShift Container Platform 4.4.19 openshift security update

Record: RHSA-2020:3579
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:3808 8.0

Red Hat Security Advisory: OpenShift Container Platform 4.3.38 jenkins and openshift security update

Record: RHSA-2020:3808
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBIT-jenkins-2020-2220 No score

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Record: BIT-jenkins-2020-2220
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	through 2.235.1	2.235.2
`org.jenkins-ci.main:jenkins-core` Maven	2.236 to 2.244	2.245
`jenkins` Alpine:v3.12	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.13	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.14	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.15	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.16	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.17	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.18	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.19	before 2.245-r0	2.245-r0

Show 30 moreShow less

Affected packages
Package	Affected	Fixed
`jenkins` Alpine:v3.20	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.21	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.22	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.23	before 2.245-r0	2.245-r0
`jenkins` Alpine:v3.24	before 2.245-r0	2.245-r0
`jenkins` Bitnami	before 2.244.1	2.244.1
`org.jenkins-ci.main:jenkins-core` Maven	before 2.235.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437	2.235.2
`org.jenkins-ci.main:jenkins-core` Maven	2.236 up to 2.245, plus listed versions 2.2372.2382.2392.2402.2412.2422.2432.244	2.245
`jenkins` Red Hat:openshift:4.4::el7	before 0:2.235.2.1597312065-1.el7	0:2.235.2.1597312065-1.el7
`jenkins` Red Hat:openshift:4.5::el7	before 0:2.235.2.1597312414-1.el7	0:2.235.2.1597312414-1.el7
`openshift` Red Hat:openshift:4.5::el7	before 0:4.5.0-202008130146.p0.git.0.aaf1d57.el7	0:4.5.0-202008130146.p0.git.0.aaf1d57.el7
`openshift-hyperkube` Red Hat:openshift:4.5::el7	before 0:4.5.0-202008130146.p0.git.0.aaf1d57.el7	0:4.5.0-202008130146.p0.git.0.aaf1d57.el7
`openshift` Red Hat:openshift:4.5::el8	before 0:4.5.0-202008130146.p0.git.0.aaf1d57.el8	0:4.5.0-202008130146.p0.git.0.aaf1d57.el8
`openshift-hyperkube` Red Hat:openshift:4.5::el8	before 0:4.5.0-202008130146.p0.git.0.aaf1d57.el8	0:4.5.0-202008130146.p0.git.0.aaf1d57.el8
`jenkins-2-plugins` Red Hat:openshift:3.11::el7	before 0:3.11.1597310986-1.el7	0:3.11.1597310986-1.el7
`openshift-ansible` Red Hat:openshift:3.11::el7	before 0:3.11.272-1.git.0.79ab6e9.el7	0:3.11.272-1.git.0.79ab6e9.el7
`openshift-ansible-docs` Red Hat:openshift:3.11::el7	before 0:3.11.272-1.git.0.79ab6e9.el7	0:3.11.272-1.git.0.79ab6e9.el7
`openshift-ansible-playbooks` Red Hat:openshift:3.11::el7	before 0:3.11.272-1.git.0.79ab6e9.el7	0:3.11.272-1.git.0.79ab6e9.el7
`openshift-ansible-roles` Red Hat:openshift:3.11::el7	before 0:3.11.272-1.git.0.79ab6e9.el7	0:3.11.272-1.git.0.79ab6e9.el7
`openshift-ansible-test` Red Hat:openshift:3.11::el7	before 0:3.11.272-1.git.0.79ab6e9.el7	0:3.11.272-1.git.0.79ab6e9.el7
`jenkins` Red Hat:openshift:3.11::el7	before 0:2.235.2.1597220898-1.el7	0:2.235.2.1597220898-1.el7
`python-rsa` Red Hat:openshift:3.11::el7	before 0:4.5-2.el7	0:4.5-2.el7
`python2-rsa` Red Hat:openshift:3.11::el7	before 0:4.5-2.el7	0:4.5-2.el7
`openshift` Red Hat:openshift:4.4::el7	before 0:4.4.0-202008250319.p0.git.0.d653415.el7	0:4.4.0-202008250319.p0.git.0.d653415.el7
`openshift-hyperkube` Red Hat:openshift:4.4::el7	before 0:4.4.0-202008250319.p0.git.0.d653415.el7	0:4.4.0-202008250319.p0.git.0.d653415.el7
`openshift` Red Hat:openshift:4.4::el8	before 0:4.4.0-202008250319.p0.git.0.d653415.el8	0:4.4.0-202008250319.p0.git.0.d653415.el8
`openshift-hyperkube` Red Hat:openshift:4.4::el8	before 0:4.4.0-202008250319.p0.git.0.d653415.el8	0:4.4.0-202008250319.p0.git.0.d653415.el8
`jenkins` Red Hat:openshift:4.3::el7	before 0:2.235.5.1600415514-1.el7	0:2.235.5.1600415514-1.el7
`openshift` Red Hat:openshift:4.3::el8	before 0:4.3.37-202009120213.p0.git.0.dffefe4.el8	0:4.3.37-202009120213.p0.git.0.dffefe4.el8
`openshift-hyperkube` Red Hat:openshift:4.3::el8	before 0:4.3.37-202009120213.p0.git.0.dffefe4.el8	0:4.3.37-202009120213.p0.git.0.dffefe4.el8

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-2220 is a medium vulnerability (CVSS 5.4) in Jenkins, published July 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.235.2.

References

Show 78 moreShow less

This page doesn't list everything

Left out here: 570 versions. The JSON record has them.