Jenkins Gitlab Hook Plugin - XSS (CVE-2020-2096)
Description
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
psychologyCrowdSec Analysis
CVE-2020-2096 is a vulnerability in the Jenkins Gitlab Hook Plugin that can allow reflected cross-site scripting (XSS) due to insufficient escaping of project names in a specific endpoint.
CrowdSec has been tracking this vulnerability and its exploits since 1st of June 2025.
Data from the CrowdSec community indicates that exploitation of CVE-2020-2096 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec network telemetry also shows that exploitation of CVE-2020-2096 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.
Observed attacks involve requests to URLs containing /gitlab/build_now and script tags.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2020-01-15 |
| Rule Released | 2025-06-01 |
| CrowdSec First Seen | 2025-06-05 |