CVE-2020-2099

At a glance

Severity: Not available
EPSS: EPSS 1.01 % · percentile 63 (2026-10-27)
State: PUBLISHED
Published: 2020-01-29
Updated: 2024-08-04
Assigner: jenkins
NVD status: Modified

Description

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-330

Advisories

GHSA-qp4f-2w67-c8hw — Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

European references

ENISA EUVD · EUVD-2022-5008
GCVE · GCVE-0-2020-2099

Affected configurations (NVD CPE)

cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* ≤ 2.204.1
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* ≤ 2.218

Affected products

Product	Versions
Jenkins project · Jenkins	affected unspecified ≤ 2.213 ; affected unspecified ≤ LTS 2.204.1

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD