{"id":"CVE-2020-2225","published":"2020-07-15T17:00:28Z","modified":"2024-08-04T07:01:41Z","title":"Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page…","vendor":"Jenkins","product":"Jenkins Matrix Project Plugin","tier":"tail","description":{"text":"Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01038,"percentile":0.63825,"provenance":"source"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1925","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2020/07/15/5","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":12.8,"factors":[{"name":"EPSS percentile","points":12.77}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Matrix Project Plugin","versions":[">= unspecified, <= 1.16"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","vulnerableRanges":["<1.17"],"patched":["1.17"],"from":["GHSA-w43x-5f8f-686p"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5490","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-1003031","published":"2019-03-08","fixed":"1.14","kev":false,"link":{"from":"CVE-2019-1003031","to":"CVE-2020-2225","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:matrix-project","fromFixed":"1.14","toFixed":"1.17","daysApart":495}]}},{"cve":"CVE-2020-2224","published":"2020-07-15","fixed":"1.17","kev":false},{"cve":"CVE-2020-2225","published":"2020-07-15","fixed":"1.17","kev":false},{"cve":"CVE-2022-20615","published":"2022-01-12","fixed":"1.20","kev":false,"link":{"from":"CVE-2020-2225","to":"CVE-2022-20615","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:matrix-project","fromFixed":"1.17","toFixed":"1.18.1","daysApart":546}]}},{"cve":"CVE-2024-23900","published":"2024-01-24","fixed":"822.824.v14451b","kev":false}],"package":"Maven:org.jenkins-ci.plugins:matrix-project"}}