# CVE-2020-2096: Jenkins Gitlab Hook Plugin - XSS

> Live exploitation tracking for CVE-2020-2096 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-2096

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.1
- **Public exploit available:** Yes
- **Affected products:** Jenkins Gitlab Hook Plugin
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** cicd, scm

## Description

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.

## CrowdSec analysis

[CVE-2020-2096](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-2096) is a vulnerability in the Jenkins Gitlab Hook Plugin that can allow reflected cross-site scripting (XSS) due to insufficient escaping of project names in a specific endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 1st of June 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2020-2096 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
CrowdSec network telemetry also shows that exploitation of CVE-2020-2096 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Observed attacks involve requests to URLs containing `/gitlab/build_now` and script tags.

## Timeline

- 2020-01-15: CVE Published. CVE-2020-2096 is published to NVD.
- 2025-06-01: Rule Released. CrowdSec releases a rule to detect CVE-2020-2096 exploitation attempts against the CrowdSec Network.
- 2025-06-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2020-2096 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2096.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-2096) follows observed exploitation activity for CVE-2020-2096. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.