CVE-2020-2173

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Gatling Plugin	>= unspecified, <= 1.2.7; >= 1.2.2, < unspecified

References

http://www.openwall.com/lists/oss-security/2020/04/07/3Mailing List
https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1633Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/04/07/3Mailing List
https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1633Third Party Advisory

Timeline

Published: Apr 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-217316.1Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin_utente.php?user_name=amministrator CVE-2020-217326.1Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code to the filename.CVE-2020-217336.1Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.CVE-2020-21746.1Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a CVE-2020-21755.4Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a sto CVE-2020-21765.4Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service CVE-2020-21774.3Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by CVE-2020-21787.1Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2020-217836.1In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.CVE-2020-217849.8phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.CVE-2020-217858.8In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability.CVE-2020-217869.8In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.