Jenkins Gitlab Hook Plugin - XSS (CVE-2020-2096)
Description
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
psychologyCrowdSec Analysis
CVE-2020-2096 is a vulnerability in the Jenkins Gitlab Hook Plugin that can allow reflected cross-site scripting (XSS) due to insufficient escaping of project names in a specific endpoint.
CrowdSec has been tracking this vulnerability and its exploits since 1st of June 2025.
Data from the CrowdSec community indicates that exploitation of CVE-2020-2096 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2020-2096. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.
Observed attacks involve requests to URLs containing /gitlab/build_now and script tags.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2020-01-15 |
| Rule Released | 2025-06-01 |
| CrowdSec First Seen | 2025-06-05 |