CVE-2020-2210
mediumpriority · track · 17OT risk · elevatedEPSS 0.007 · 51 %ileEUUSEPSS · scored 2026-10-28
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.1–4.3
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- Maven org.jenkins-ci.plugins:StashBranchParameter≤ 0.3.0osvUSpkg:maven/org.jenkins-ci.plugins/StashBranchParameter
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-3f82-v3qw-53q7Passwords transmitted in plain text by Jenkins Stash Branch Parameter Plugin2022-05-24ghsa · osvUS
Stash Branch Parameter Plugin stores Stash API passwords in its global configuration file `org.jenkinsci.plugins.StashBranchParameter.StashBranchParameterDefinition.xml` on the Jenkins controller as part of its configuration. While the password is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Stash Branch Parameter Plugin 0.3.0 and earlier. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations. This only affects Jenkins before 2.236, including 2.235.x LTS, as Jenkins 2.236 introduces a security hardening that transparently encrypts and decrypts data used for a Jenkins password form field.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2020/07/02/7cnnvd
- https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1656cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-2210cnnvd
- https://vigilance.fr/vulnerability/Jenkins-Plugins-multiple-vulnerabilities-32697cnnvd
- http://www.openwall.com/lists/oss-security/2020/07/02/7enisa_euvd
- https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1656enisa_euvd
- http://www.openwall.com/lists/oss-security/2020/07/02/7Third Party Advisorynvd
- https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1656Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan