Lucene search

JenkinsCVE-2020-2212

HistoryJul 02, 2020 - 3:15 p.m.

CVE-2020-2212

2020-07-0215:15:18

CWE-522

jenkins

web.nvd.nist.gov

jenkins

github

coverage

reporter

plugin

security

vulnerability

nvd

cve-2020-2212

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

23.0%

JSON

Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system or read permissions on the system configuration.

Affected configurations

Nvd

Node

jenkinsgithub_coverage_reporterRange≤1.8jenkins

VendorProductVersionCPE
jenkinsgithub_coverage_reporter*cpe:2.3:a:jenkins:github_coverage_reporter:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	github_coverage_reporter	*	cpe:2.3:a:jenkins:github_coverage_reporter::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins GitHub Coverage Reporter Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.8",
        "versionType": "custom"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2020/07/02/7

jenkins.io/security/advisory/2020-07-02/#SECURITY-1632

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

23.0%

JSON

Related for CVE-2020-2212