CVE-2020-2317

2020-11-0415:15:12

Google

osv.dev

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin’s post build step.

CPENameOperatorVersion
findbugs-plugineqfindbugs-4.47
findbugs-plugineqfindbugs-4.39
findbugs-plugineqfindbugs-4.44
findbugs-plugineqparent-1.3
findbugs-plugineqfindbugs-4.51
findbugs-plugineqfindbugs-4.63
findbugs-plugineqfindbugs-4.21
findbugs-plugineqfindbugs-4.41
findbugs-plugineqlibrary-3.0.2
findbugs-plugineqfindbugs-4.26

Name	Operator	Version
findbugs-plugin	eq	findbugs-4.47
findbugs-plugin	eq	findbugs-4.39
findbugs-plugin	eq	findbugs-4.44
findbugs-plugin	eq	parent-1.3
findbugs-plugin	eq	findbugs-4.51
findbugs-plugin	eq	findbugs-4.63
findbugs-plugin	eq	findbugs-4.21
findbugs-plugin	eq	findbugs-4.41
findbugs-plugin	eq	library-3.0.2
findbugs-plugin	eq	findbugs-4.26