CVE-2020-2184

published 2020-05-06

CVE-2020-2184: A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an…

Priority P4 32 medium 4.3 CVSS 3.1

AV N AC L PR N UI R S U C N I L A N

A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
jenkins	amazon_ec2_plugin	—	—
jenkins	copy_artifact_plugin	—	—
jenkins	credentials_binding_plugin	—	—
jenkins	current_versions_systems	<= 2.15	—
jenkins	cvs_plugin	—	—
jenkins	for_more_information_see_the_plugin	—	—
jenkins	ids_in_amazon_ec2_plugin	—	—
jenkins	ids_to_allow_users_configuring_the_plugin	—	—
jenkins	scm_filter_jervis_plugin	—	—
jenkins	when_updating_the_plugin	—	—
jenkins_project	jenkins_cvs_plugin	unspecified – 2.15	—

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352