Jenkins Echarts API vulnerabilities

2 CVEs affecting Jenkins Echarts API, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2194, published 2020-06-03.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-2194, published 2020-06-03. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.
• CVE-2020-2193, published 2020-06-03. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability.