CVE-2020-2249
First published: Tue Sep 01 2020(Updated: )
Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Team Foundation Server | <=5.157.1 | |
| maven/org.jenkins-ci.plugins:tfs | <=5.157.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2020-2249.
What is the title of the vulnerability?
The title of the vulnerability is 'Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its...'
What is the description of the vulnerability?
The vulnerability allows attackers with access to the Jenkins controller file system to view an unencrypted webhook secret stored in a global configuration file.
What is the affected software?
The affected software is Jenkins Team Foundation Server Plugin version 5.157.1 and earlier.
What is the severity of this vulnerability?
The severity of the vulnerability is low, with a severity score of 3.3.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-w6c2-jrhh-jrxg
- alias/CVE-2020-2249
- collector/github-advisory
- collector/nvd-cve
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- agent/trending
- vendor/jenkins
- canonical/jenkins team foundation server
- version/jenkins team foundation server/5.157.1
- package-manager/maven