CVE-2020-2275
Last modified
CVE-2020-2275 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller.. EPSS estimates a 1.70% chance of exploitation in the next 30 days.
Description
Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Copy Data To Workspace | <= 1.0 |
References
- http://www.openwall.com/lists/oss-security/2020/09/16/3Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/09/16/3Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-2275?
How severe is CVE-2020-2275?
How do I fix CVE-2020-2275?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-22723A cross-site scripting (XSS) vulnerability in Beijing Liangj…6.1
- CVE-2020-22724A remote command execution vulnerability exists in add_serve…9.8
- CVE-2020-2273A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
- CVE-2020-22732CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Ext…4.8
- CVE-2020-2274Jenkins ElasTest Plugin 1.2.1 and earlier stores its server …5.5
- CVE-2020-22741An issue was discovered in Xuperchain 3.6.0 that allows for …7.5
- CVE-2020-22755File upload vulnerability in MCMS 5.0 allows attackers to ex…8.8
- CVE-2020-2276Jenkins Selection tasks Plugin 1.0 and earlier executes a us…8.8
- CVE-2020-22761Cross Site Request Forgery (CSRF) vulnerability in FlatPress…8.8
- CVE-2020-22765Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4…6.1
- CVE-2020-2277Jenkins Storable Configs Plugin 1.0 and earlier allows users…6.5
- CVE-2020-2278Jenkins Storable Configs Plugin 1.0 and earlier does not res…6.5
Are you affected by CVE-2020-2275?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST