Lucene search

JenkinsCVE-2020-2210

HistoryJul 02, 2020 - 3:15 p.m.

CVE-2020-2210

2020-07-0215:15:17

CWE-319

jenkins

web.nvd.nist.gov

jenkins

stash

branch

plugin

passwords

plain text

vulnerability

security

cve-2020-2210

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

36.1%

JSON

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

Affected configurations

Nvd

Node

jenkinsstash_branch_parameterRange≤0.3.0jenkins

VendorProductVersionCPE
jenkinsstash_branch_parameter*cpe:2.3:a:jenkins:stash_branch_parameter:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	stash_branch_parameter	*	cpe:2.3:a:jenkins:stash_branch_parameter::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Stash Branch Parameter Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "0.3.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 0.3.0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2020/07/02/7

jenkins.io/security/advisory/2020-07-02/#SECURITY-1656

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

36.1%

JSON

Related for CVE-2020-2210