CVE-2020-2214: Content-Security-Policy protection disabled by Jenkins ZAP Pipeline Plugin
Summary
CVE-2020-2214: Content-Security-Policy protection for user content disabled by Jenkins ZAP Pipeline Plugin. Affects com.vrondakis.zap:zap-pipeline versions < 1.10. Fixed in 1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins ZAP Pipeline Plugin is a plugin for the Jenkins automation server that integrates with the OWASP ZAP security tool. It allows users to perform security scans on their Jenkins pipelines. The plugin is commonly used in software development and continuous integration workflows to ensure the security of applications. However, a vulnerability has been discovered in versions prior to 1.10 of the plugin that disables the Content-Security-Policy protection for user content served by Jenkins. This vulnerability can lead to cross-site scripting (XSS) attacks by users who have control over files in workspaces, archived artifacts, etc.
Vulnerability Detail
The ZAP Pipeline Plugin in Jenkins, before version 1.10, globally disables the Content-Security-Policy header for static files served by Jenkins. This header is responsible for protecting user content from XSS attacks. By disabling this header, users with the ability to control files in workspaces, archived artifacts, etc., can inject malicious scripts into the served content, potentially leading to XSS attacks. Jenkins instances with Resource Root URL configured are largely unaffected, except for file parameter downloads. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.4.
How To Fix
Latest published version: 1.16 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to upgrade to the latest version of the ZAP Pipeline Plugin to ensure the Content-Security-Policy protection is enabled.
Conclusion
The Jenkins ZAP Pipeline Plugin prior to version 1.10 disables the Content-Security-Policy protection for user content served by Jenkins, making it vulnerable to cross-site scripting (XSS) attacks. Users should upgrade to version 1.10 or newer of the plugin to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vrondakis.zap:zap-pipeline →
FAQ
The Jenkins ZAP Pipeline Plugin is a plugin for the Jenkins automation server that integrates with the OWASP ZAP security tool. It allows users to perform security scans on their Jenkins pipelines.
This vulnerability allows users with control over files in workspaces, archived artifacts, etc., to inject malicious scripts into the served content, potentially leading to cross-site scripting (XSS) attacks.
Versions of the ZAP Pipeline Plugin prior to 1.10 are affected by this vulnerability.
Jenkins instances with Resource Root URL configured are largely unaffected, except for file parameter downloads. The behavior of file parameter downloads depends on the specific version of Jenkins.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.4.
