TI-2020-02083 Aliases CVE-2020-2206 GHSA-fq52-6cjf-jw59

Cross-site scripting in Jenkins VncRecorder Plugin

LOW 29CWE-79Published 2020-07-02 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

Why it matters now

EPSS 0.00871 59th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:vncrecorder (Maven): 1.35

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins VncRecorder Plugin	up to 1.25	—	No fix listed	CNA
—	org.jenkins-ci.plugins:vncrecorder (Maven)	before 1.35	1.35	Patch available	GHSA-fq52-6cjf-jw59

Jenkins VncRecorder Plugin VendorJenkins Affected up to 1.25 Fixed in — No fix listed CNA
org.jenkins-ci.plugins:vncrecorder (Maven) Vendor— Affected before 1.35 Fixed in 1.35 Patch available GHSA-fq52-6cjf-jw59

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:vncrecorder::::::jenkins::*	up to 1.25	Vulnerable	Jenkins

cpe:2.3:a:jenkins:vncrecorder:*:*:*:*:*:jenkins:*:* Versions up to 1.25 Vulnerable ·Jenkins

Remediation

Fix · GHSA-fq52-6cjf-jw59 org.jenkins-ci.plugins:vncrecorder (Maven) Fixed in 1.35 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-2206
2026-10-03 Alias added: GHSA-fq52-6cjf-jw59

References

Advisory 3

Other 2

TI-2020-02082 Cross-site scripting in Jenkins VncRecorder Plugin CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences