CVE-2020-2153

EPSS 0.02%
Veröffentlicht 09.03.2020 16:15:14
Zuletzt bearbeitet 21.11.2024 05:24:48
Quelle jenkinsci-cert@googlegroups.co
Teams Watchlist Login
Unerledigt Login

Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Backlog SwPlatformjenkins Version <= 2.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.02%	0.037

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

http://www.openwall.com/lists/oss-security/2020/03/09/1

Third Party Advisory

Mailing List

https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1510

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-2153

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-2153

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-2153

EUVD