CVE-2020-2249

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

Score

CVSS 3.1 3.3 Low

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2020-09-01

Last modified

2024-08-04

Weaknesses

CWE-311

Affected products

• Team Foundation Server (Jenkins)
• Jenkins Team Foundation Server Plugin (Jenkins Project)

References

• http://www.openwall.com/lists/oss-security/2020/09/01/3
• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506