CVE-2020-2160
Cross-Site Request Forgery in Jenkins
8.8 HighFix available
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
2.04%Up 1.4 points since Apr 14, 2021
What each source reports
NVD Score used
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
CVE-2020-2160- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
CVE-2020-2160- Updated
- 2026-11-02
EUVDEUVD-2022-3520 No score
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
EUVD-2022-3520- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c735-g9f2-2mvp
Cross-Site Request Forgery in Jenkins
An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.
Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.
Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.
In case of problems, administrators can disable this security fix by setting the system property hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO to true.
As an additional safeguard, semicolon (;) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath to true.
- Record
GHSA-c735-g9f2-2mvp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352, CWE-435
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-2160
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
ALPINE-CVE-2020-2160- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
CVE-2020-2160- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-c735-g9f2-2mvp
Cross-Site Request Forgery in Jenkins
An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.
Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.
Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.
In case of problems, administrators can disable this security fix by setting the system property hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO to true.
As an additional safeguard, semicolon (;) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath to true.
- Record
GHSA-c735-g9f2-2mvp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352, CWE-435
- Updated
- 2026-11-02
OSVRHBA-2020:2435
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.25 packages update
- Record
RHBA-2020:2435- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHBA-2020:2444
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.8 packages update
- Record
RHBA-2020:2444- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHBA-2020:2477
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update
- Record
RHBA-2020:2477- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-jenkins-2020-2160 No score
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
BIT-jenkins-2020-2160- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
through 2.204.5 | 2.204.6 |
org.jenkins-ci.main:jenkins-coreMaven |
2.205 to 2.227 | 2.228 |
jenkinsAlpine:v3.11 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.12 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.13 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.14 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.15 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.16 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.17 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.18 |
before 2.228-r0 | 2.228-r0 |
Show 90 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jenkinsAlpine:v3.19 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.20 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.21 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.22 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.23 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.24 |
before 2.228-r0 | 2.228-r0 |
jenkinsBitnami |
before 2.227.1 | 2.227.1 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.204.6, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.204.6 |
org.jenkins-ci.main:jenkins-coreMaven |
2.205 up to 2.228, plus listed versions 2.2062.2072.2082.2092.210 Show 20 moreShow less2.2112.2122.2132.2142.2152.2162.2172.2182.2192.2202.2212.2222.222.12.222.32.222.42.2232.2242.2252.2262.227 |
2.228 |
atomic-enterprise-service-catalogRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 1:4.3.25-202006081518.git.1.52b3a66.el7 | 1:4.3.25-202006081518.git.1.52b3a66.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 1:4.3.25-202006081518.git.1.52b3a66.el7 | 1:4.3.25-202006081518.git.1.52b3a66.el7 |
atomic-openshift-service-idlerRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:4.3.25-202006081518.git.1.79365c5.el7 | 0:4.3.25-202006081518.git.1.79365c5.el7 |
conmonRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 2:2.0.17-1.rhaos4.3.el7 | 2:2.0.17-1.rhaos4.3.el7 |
cri-oRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 |
cri-o-debuginfoRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 |
jenkinsRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:2.222.1.1591349991-1.el7 | 0:2.222.1.1591349991-1.el7 |
openshiftRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.96c30f6.el7 | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
openshift-ansibleRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.1253fde.el7 | 0:4.3.25-202006060952.git.1.1253fde.el7 |
openshift-ansible-testRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.1253fde.el7 | 0:4.3.25-202006060952.git.1.1253fde.el7 |
openshift-clientsRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.fd93102.el7 | 0:4.3.25-202006060952.git.1.fd93102.el7 |
openshift-clients-redistributableRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.fd93102.el7 | 0:4.3.25-202006060952.git.1.fd93102.el7 |
openshift-hyperkubeRed Hat:openshift:4.3::el7 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.96c30f6.el7 | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
conmonRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.0.17-1.rhaos4.3.el8 | 2:2.0.17-1.rhaos4.3.el8 |
cri-oRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
cri-o-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
cri-o-debugsourceRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
machine-config-daemonRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006081518.git.1.478b31a.el8 | 0:4.3.25-202006081518.git.1.478b31a.el8 |
openshiftRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.96c30f6.el8 | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
openshift-clientsRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.fd93102.el8 | 0:4.3.25-202006060952.git.1.fd93102.el8 |
openshift-clients-redistributableRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.fd93102.el8 | 0:4.3.25-202006060952.git.1.fd93102.el8 |
openshift-hyperkubeRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006060952.git.1.96c30f6.el8 | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
openshift-kuryrRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
openshift-kuryr-cniRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
openshift-kuryr-commonRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
openshift-kuryr-controllerRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
python3-kuryr-kubernetesRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
s390utilsRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-baseRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-base-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cmsfsRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cmsfs-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cmsfs-fuseRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cmsfs-fuse-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cpacfstatsdRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cpacfstatsd-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cpuplugdRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cpuplugd-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-debugsourceRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-develRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-hmcdrvfsRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-hmcdrvfs-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-iucvtermRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-iucvterm-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-mon_statdRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-mon_statd-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-osasnmpdRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-osasnmpd-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-zdsfsRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-zdsfs-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-ziomonRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-ziomon-debuginfoRed Hat:openshift:4.3::el8 From an advisory covering 4 CVEs |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
atomic-enterprise-service-catalogRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 1:4.4.0-202006080017.git.1.77a5cc9.el7 | 1:4.4.0-202006080017.git.1.77a5cc9.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 1:4.4.0-202006080017.git.1.77a5cc9.el7 | 1:4.4.0-202006080017.git.1.77a5cc9.el7 |
atomic-openshift-service-idlerRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:4.4.0-202006080017.git.1.7e463c3.el7 | 0:4.4.0-202006080017.git.1.7e463c3.el7 |
conmonRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 2:2.0.17-1.rhaos4.4.el7 | 2:2.0.17-1.rhaos4.4.el7 |
cri-oRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 |
cri-o-debuginfoRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 |
jenkinsRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:2.222.1.1591351066-1.el7 | 0:2.222.1.1591351066-1.el7 |
openshiftRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.dc84fb4.el7 | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
openshift-ansibleRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.a996454.el7 | 0:4.4.0-202006061254.git.1.a996454.el7 |
openshift-ansible-testRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.a996454.el7 | 0:4.4.0-202006061254.git.1.a996454.el7 |
openshift-clientsRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.26cb6dc.el7 | 0:4.4.0-202006061254.git.1.26cb6dc.el7 |
openshift-clients-redistributableRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.26cb6dc.el7 | 0:4.4.0-202006061254.git.1.26cb6dc.el7 |
openshift-hyperkubeRed Hat:openshift:4.4::el7 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.dc84fb4.el7 | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
conmonRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 2:2.0.17-1.rhaos4.4.el8 | 2:2.0.17-1.rhaos4.4.el8 |
cri-oRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
cri-o-debuginfoRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
cri-o-debugsourceRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
machine-config-daemonRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006080017.git.1.32e0736.el8 | 0:4.4.0-202006080017.git.1.32e0736.el8 |
openshiftRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.dc84fb4.el8 | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
openshift-clientsRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.26cb6dc.el8 | 0:4.4.0-202006061254.git.1.26cb6dc.el8 |
openshift-clients-redistributableRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.26cb6dc.el8 | 0:4.4.0-202006061254.git.1.26cb6dc.el8 |
openshift-hyperkubeRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006061254.git.1.dc84fb4.el8 | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
openshift-kuryrRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
openshift-kuryr-cniRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
openshift-kuryr-commonRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
openshift-kuryr-controllerRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
python3-kuryr-kubernetesRed Hat:openshift:4.4::el8 From an advisory covering 4 CVEs |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:2.222.1.1591351669-1.el7 | 0:2.222.1.1591351669-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2160 is a high vulnerability (CVSS 8.8) in Jenkins, published March 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.204.6.
References
jenkins.io/security/advisory/2020-03-25
openwall.com/lists/oss-security/2020/03/25/2
nvd.nist.gov/vuln/detail/CVE-2020-2160
github.com/jenkinsci/jenkins/commit/f7cf28355973df1ca6eb19066370bf70b10742f7
Show 41 moreShow less
security.alpinelinux.org/vuln/CVE-2020-2160
access.redhat.com/errata/RHBA-2020:2435
bugzilla.redhat.com/show_bug.cgi?id=1843457
security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_2435.json
cve.org/CVERecord?id=CVE-2020-2160
This page doesn't list everything
Left out here: 534 versions. The JSON record has them.