CVE-2020-2194

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins ECharts API Plugin	>= unspecified, <= 4.7.0-3

References

http://www.openwall.com/lists/oss-security/2020/06/03/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1842Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/06/03/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1842Vendor Advisory

Timeline

Published: Jun 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-21955.4Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scrip CVE-2020-21968.0Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative CVE-2020-219674.8File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file pa CVE-2020-21974.3Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Pro CVE-2020-219768.8An arbitrary file upload in the <input type="file" name="user_image"> component of NewsOne CMS v1.1.0 allows attackers to webshell and execu CVE-2020-21986.5Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting CVE-2020-219876.1HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS). XSS vulnerabilities occur when input passed via several parameter CVE-2020-219898.8HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF). The application interface allows users to perform certain actions via CVE-2020-21996.1Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form vali CVE-2020-219907.5Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to imp CVE-2020-219919.8AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin CVE-2020-219928.8Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. The issue exist due t