CVE-2020-2161

16

FAUCET Score

CVE-2020-2161 is a stored cross-site scripting (XSS) vulnerability affecting Jenkins versions 2.227 and earlier, and LTS 2.204.5 and earlier. It arises from improper escaping of node labels displayed in form validation for label expressions on job configuration pages. With a CVSS score of 5.4 (Medium), this vulnerability allows authenticated users with the ability to define node labels to inject malicious scripts, potentially leading to information disclosure or limited integrity impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 2.204.5CPE matchmatch criteria	cpe:2.3:a:jenkins:jenkins:::::lts:::*
		<= 2.227CPE matchmatch criteria	cpe:2.3:a:jenkins:jenkins:::::-:::*
		<= 2.227CPE match	cpe:2.3:a:jenkins:jenkins::::::::

CVSS Data

CVSS version used by this source: 3.1

5.4MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

2.3

Impact Score

2.7

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.24%

Probability of exploitation in next 30 days

EPSS Percentile

66.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0124 is in the 95th percentile among its peer group of 15,239 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (24)

mavenpatch availablevia ghsa

Product: org.jenkins-ci.main:jenkins-coreFixed in: 2.204.6

mavenpatch availablevia ghsa

Product: org.jenkins-ci.main:jenkins-coreFixed in: 2.228

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: jenkins-0:2.222.1.1591351669-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: atomic-enterprise-service-catalog-1:4.3.25-202006081518.git.1.52b3a66.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: atomic-openshift-service-idler-0:4.3.25-202006081518.git.1.79365c5.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: conmon-2:2.0.17-1.rhaos4.3.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: cri-o-0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: jenkins-0:2.222.1.1591349991-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: machine-config-daemon-0:4.3.25-202006081518.git.1.478b31a.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: openshift-0:4.3.25-202006060952.git.1.96c30f6.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: openshift-ansible-0:4.3.25-202006060952.git.1.1253fde.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: openshift-clients-0:4.3.25-202006060952.git.1.fd93102.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: openshift-kuryr-0:4.3.25-202006081518.git.1.240b401.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.3Fixed in: s390utils-2:2.6.0-23.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: atomic-enterprise-service-catalog-1:4.4.0-202006080017.git.1.77a5cc9.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: atomic-openshift-service-idler-0:4.4.0-202006080017.git.1.7e463c3.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: conmon-2:2.0.17-1.rhaos4.4.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: cri-o-0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: jenkins-0:2.222.1.1591351066-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: machine-config-daemon-0:4.4.0-202006080017.git.1.32e0736.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: openshift-ansible-0:4.4.0-202006061254.git.1.a996454.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: openshift-clients-0:4.4.0-202006061254.git.1.26cb6dc.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.4Fixed in: openshift-kuryr-0:4.4.0-202006080017.git.1.855ef1d.el8

Vendor Advisories (2)

mavenGHSA-g8pg-qrvm-wgh2medium

Improper Neutralization of Input During Web Page Generation in Jenkins

redhatCVE-2020-2161Moderate

jenkins: XSS in job configuration pages

References

jenkins.io / security/advisory/2020-03-25

Vendor Advisory

openwall.com / lists/oss-security/2020/03/25/2

Mailing ListThird Party Advisory