CVE-2020-2153

Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.

Score

CVSS 3.1 4.3 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2020-03-09

Last modified

2024-08-04

Weaknesses

CWE-319

Affected products

• Backlog (Jenkins)
• Jenkins Backlog Plugin (Jenkins Project)

References

• http://www.openwall.com/lists/oss-security/2020/03/09/1
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1510