{"id":"CVE-2020-2190","aliases":["EUVD-2022-4918","GHSA-q87g-7mp5-765q","RHSA-2020:3207","RHSA-2020:3625"],"status":"published","title":"Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin","description":"Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00754,"percentile":0.55352,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-06-03T12:40:23Z","modified":"2026-10-24T10:31:04Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","fixed_in":["1.73"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:4.5::el7","package":"jenkins-2-plugins","fixed_in":["0:4.5.1595405982-1.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.72"},{"fixed":"1.73"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.0","1.0-beta-1","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-beta-5","1.0-beta-6","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.18.1","1.19","1.2","1.20","1.21","1.22","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.29.1","1.3","1.30","1.31","1.33","1.34","1.35","1.36","1.37","1.38","1.39","1.4","1.40","1.41","1.42","1.43","1.44","1.44.1","1.45","1.46","1.46.1","1.47","1.48","1.49","1.5","1.50","1.51","1.52","1.53","1.54","1.54.1","1.54.2","1.54.3","1.54.4","1.55","1.56","1.57","1.57.1","1.57.2","1.57.3","1.57.4","1.57.5","1.57.6","1.58","1.59","1.6","1.60","1.60.1","1.61","1.62","1.63","1.63.1","1.64","1.65","1.66","1.66.1","1.66.2","1.66.3","1.66.4","1.66.5","1.67","1.68","1.69","1.7","1.70","1.71","1.72","1.8","1.9"]},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.1595405982-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.1598545590-1.el7"}]}],"bundled":6}],"products":[{"vendor":"jenkins","product":"script_security"},{"vendor":"jenkins project","product":"jenkins script security plugin"}],"references":[{"url":"https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1866","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2020/06/03/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2190","tags":["advisory"]},{"url":"https://github.com/jenkinsci/script-security-plugin/commit/99e6ac0df5fe0f0cc6c2a695f7c1f845279bedbd","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q87g-7mp5-765q"},{"url":"https://access.redhat.com/errata/RHSA-2020:3207","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847337","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3207.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2190","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2190","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3625","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1861840","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3625.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2181","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2182","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1835","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2224","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2225","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2225","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2226","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-2190","description":"Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.","status":"published","published":"2020-06-03T12:40:23Z","modified":"2024-08-04T07:01:41.24Z","updated_at":"2026-11-02T14:35:51.206854Z"}],"euvd":[{"id":"EUVD-2022-4918","description":"Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.","status":"published","published":"2020-06-03T12:40:23Z","modified":"2024-08-04T07:01:41Z","updated_at":"2026-11-03T03:08:09.929524Z"}],"ghsa":[{"id":"GHSA-q87g-7mp5-765q","title":"Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin","description":"Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.","status":"published","published":"2022-05-24T17:19:04Z","modified":"2023-12-20T13:39:21Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:27.414424Z"}],"nvd":[{"id":"CVE-2020-2190","description":"Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.","status":"published","published":"2020-06-03T13:15:10.54Z","modified":"2026-06-17T03:11:57.447Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:04.922138Z"}],"osv":[{"id":"CVE-2020-2190","description":"Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.","status":"published","published":"2020-06-03T13:15:10.54Z","modified":"2026-10-24T10:31:04.14274903Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"GHSA-q87g-7mp5-765q","title":"Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin","description":"Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.","status":"published","published":"2022-05-24T17:19:04Z","modified":"2024-02-16T08:16:33.561676Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"RHSA-2020:3207","title":"Red Hat Security Advisory: OpenShift Container Platform 4.5.4 jenkins-2-plugins security update","status":"published","published":"2024-09-16T04:38:42Z","modified":"2025-11-22T12:05:38Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3625","title":"Red Hat Security Advisory: OpenShift Container Platform 4.4.20 jenkins-2-plugins security update","status":"published","published":"2024-09-16T04:41:12Z","modified":"2026-06-27T10:11:06Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"}]}}