CVE-2020-2099

En bref

Sévérité: Non disponible
EPSS: EPSS 1.01 % · centile 63 (2026-10-27)
État: PUBLISHED
Publiée: 2020-01-29
Mise à jour: 2024-08-04
Attribuée par: jenkins
Statut NVD: Modified

Description

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-330

Avis

GHSA-qp4f-2w67-c8hw — Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

Références européennes

ENISA EUVD · EUVD-2022-5008
GCVE · GCVE-0-2020-2099

Configurations affectées (CPE NVD)

cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* ≤ 2.204.1
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* ≤ 2.218

Produits affectés

Produit	Versions
Jenkins project · Jenkins	affected unspecified ≤ 2.213 ; affected unspecified ≤ LTS 2.204.1

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD