CVE-2020-2190
Fixed in a distro release EPSS <1%
Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
Products: Jenkins project Jenkins Script Security Plugin
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.plugins:script-security | 1.73 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.4 | jenkins-2-plugins | 0:4.4.1598545590-1.el7 |
| Red Hat openshift 4.5 | jenkins-2-plugins | 0:4.5.1595405982-1.el7 |