Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6gvv-5195-cbhh
Vulnerability ID VCID-6gvv-5195-cbhh
Aliases CVE-2020-2111
GHSA-x3pr-fcgm-wjgc
Summary Subversion Plugin stored XSS vulnerability Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability. Subversion Plugin 2.13.1 escapes the affected part of the error message.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2111.json
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-2111
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-x3pr-fcgm-wjgc
cvssv3.1 5.4 https://github.com/jenkinsci/subversion-plugin
generic_textual MODERATE https://github.com/jenkinsci/subversion-plugin
cvssv3.1 5.4 https://github.com/jenkinsci/subversion-plugin/commit/545ca52f6de9af7541621bbea716ead449cd2b98
generic_textual MODERATE https://github.com/jenkinsci/subversion-plugin/commit/545ca52f6de9af7541621bbea716ead449cd2b98
cvssv3.1 5.4 https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725
generic_textual MODERATE https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2020-2111
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-2111
cvssv3.1 5.4 http://www.openwall.com/lists/oss-security/2020/02/12/3
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2020/02/12/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2111.json
https://api.first.org/data/v1/epss?cve=CVE-2020-2111
https://github.com/jenkinsci/subversion-plugin
https://github.com/jenkinsci/subversion-plugin/commit/545ca52f6de9af7541621bbea716ead449cd2b98
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725
https://nvd.nist.gov/vuln/detail/CVE-2020-2111
http://www.openwall.com/lists/oss-security/2020/02/12/3
1819105 https://bugzilla.redhat.com/show_bug.cgi?id=1819105
GHSA-x3pr-fcgm-wjgc https://github.com/advisories/GHSA-x3pr-fcgm-wjgc
RHSA-2020:2478 https://access.redhat.com/errata/RHSA-2020:2478
RHSA-2020:2737 https://access.redhat.com/errata/RHSA-2020:2737
RHSA-2020:3616 https://access.redhat.com/errata/RHSA-2020:3616
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2111.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/jenkinsci/subversion-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/jenkinsci/subversion-plugin/commit/545ca52f6de9af7541621bbea716ead449cd2b98
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-2111
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2020/02/12/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.24351
EPSS Score 0.00083
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:09:55.379051+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x3pr-fcgm-wjgc/GHSA-x3pr-fcgm-wjgc.json 38.0.0