1. Home
  2. CVE Database
  3. CVE-2020-2173
MEDIUM · 5.4

CVE-2020-2173

Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able t...

Vulnerability Description

Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
JenkinsGatling<= 1.2.7

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2020-2173?

CVE-2020-2173 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able t...

How severe is CVE-2020-2173?

CVE-2020-2173 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-2173?

Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Gatling.