CVE-2020-2244: Jenkins Build Failure Analyzer

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.

Affected products

• Jenkins Build Failure Analyzer: up to and including 1.27.0

Published 2020-09-01. Last modified 2026-06-17.