WaratekVRT Sign in

CVE-2020-2096 Jenkins Gitlab Hook

Affected softwareJenkins Gitlab Hook
Severity6.1 Medium CVSS 3.1 2 scores
WeaknessCross-site scripting (CWE-79)
Published15 Jan 2020
Updated17 Jun 2026

Description

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2025-06-07.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Nuclei; first seen 2020-01-16.
  • EPSS 93% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-2096 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation app.crowdsec.net /cti/cve-explorer/CVE-2020-2096 2025-06-07
IndexArtifactStarsFirst seen
Exploit-DB Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting 2020-01-16
Nuclei Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: org.jenkins-ci.ruby-plugins:gitlab-hook), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

CVSS

6.1 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.jenkins-ci.ruby-plugins:gitlab-hook 0 none 1.4.2

Products and versions

2 products, 2 version entries
SourceVendorProductSchemeAffected versions
nvd jenkins gitlab hook generic ≤ 1.4.2
osv org.jenkins-ci.ruby-plugins gitlab-hook generic ≤ 1.4.2

References

URLTags
https://github.com/jenkinsci/gitlab-hook-plugin PACKAGE
https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1683 WEB
http://packetstormsecurity.com/files/155967/Jenkins-Gitlab-Hook-1.4.2-Cross-Site-Scripting.html WEB
http://www.openwall.com/lists/oss-security/2020/01/15/1 WEB

Timeline
Published2020-01-15By the CVE Program.
VulnCheck KEV: earliest evidence2025-06-07Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.