CVE-2020-2140: Jenkins Audit Trail Plugin reflected XSS in URL Patterns validation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityReflected XSS requires user interaction and is confined to the Jenkins UI, but the plugin is widely deployed and EPSS is very high, so it warrants prompt patching.

What it is

Jenkins Audit Trail Plugin 3.2 and earlier fails to escape the error message shown for URL Patterns field form validation, producing a reflected cross-site scripting flaw. An attacker who can get a victim to submit crafted input to that form can execute script in the victim's Jenkins session. The issue is limited to the plugin's form validation path and requires user interaction.

Impact

An attacker can run arbitrary JavaScript in the context of the victim's Jenkins session, potentially reading data or performing actions as that user. The CVSS scope change (S:C) reflects that the script executes in the Jenkins origin rather than the attacker's.

Attack surface

Reached over the network through the plugin's URL Patterns form validation endpoint; no authentication is required by the vector (PR:N), but the victim must interact with a crafted request or link (UI:R). The description does not state whether the endpoint is reachable pre-authentication in practice.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tag appears in the references, which are only vendor and mailing-list advisories. EPSS is high (0.75975, 99.5th percentile), indicating elevated predicted likelihood, but that is a model estimate, not confirmed exploitation.

What to do

• Upgrade Jenkins Audit Trail Plugin past version 3.2 to the fixed release named in the vendor advisory SECURITY-1722.
• If immediate upgrade is not possible, restrict access to Jenkins form validation endpoints and the Audit Trail configuration UI to trusted administrators.
• Apply output encoding to validation error messages so user-supplied URL Patterns input is not reflected unescaped.
• Enforce a strict Content-Security-Policy on the Jenkins UI to reduce script execution impact.
• Review Jenkins access controls so untrusted users cannot reach administrative configuration forms.

Detection

• Search Jenkins logs and HTTP access logs for requests to Audit Trail URL Patterns validation endpoints containing script-like payloads in parameters.
• Monitor for reflected payload strings (for example script tags or event handlers) appearing in Jenkins error responses.
• Alert on Audit Trail plugin configuration changes or validation requests from unexpected source addresses.
• Correlate Jenkins session activity following suspicious validation requests for signs of session abuse.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.