CVE-2020-2275

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

1.70%

Published

Sep 16, 2020

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

Affected Products (1)

jenkins · copy_data_to_workspacevulnerable

References (4)

http://www.openwall.com/lists/oss-security/2020/09/16/3

Third Party Advisory

https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1966

Vendor Advisory

http://www.openwall.com/lists/oss-security/2020/09/16/3

Third Party Advisory

https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1966

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs