CVE-2020-2104

Memory usage graphs accessible to anyone with Overall/Read

4.3 MediumFix available

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.07%Down 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 4.3

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

Record: CVE-2020-2104
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

CVE List No score

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

Record: CVE-2020-2104
Updated: 2026-11-02

EUVDEUVD-2022-5121 No score

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

Record: EUVD-2022-5121
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r78q-qgx6-64pp 4.3

Memory usage graphs accessible to anyone with Overall/Read

Jenkins includes a feature that shows a JVM memory usage chart for the Jenkins controller.

Access to the chart in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier requires no permissions beyond the general Overall/Read, allowing users who are not administrators to view JVM memory usage data.

Jenkins 2.219, LTS 2.204.2 now requires Overall/Administer permissions to view the JVM memory usage chart.

Record: GHSA-r78q-qgx6-64pp
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-285, CWE-863
Updated: 2026-11-02

OSV 4.3

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

Record: CVE-2020-2104
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-r78q-qgx6-64pp 4.3

Memory usage graphs accessible to anyone with Overall/Read

Jenkins includes a feature that shows a JVM memory usage chart for the Jenkins controller.

Jenkins 2.219, LTS 2.204.2 now requires Overall/Administer permissions to view the JVM memory usage chart.

Record: GHSA-r78q-qgx6-64pp
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-285, CWE-863
Updated: 2026-11-02

OSVRHBA-2020:0402 8.6

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update

Record: RHBA-2020:0402
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated: 2026-11-02

OSVRHBA-2020:0675 8.6

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.5 packages update

Record: RHBA-2020:0675
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated: 2026-11-02

OSVBIT-jenkins-2020-2104 No score

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

Record: BIT-jenkins-2020-2104
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	through 2.204.1	2.204.2
`org.jenkins-ci.main:jenkins-core` Maven	2.205 to 2.218	2.219
`jenkins` Bitnami	before 2.218.1	2.218.1
`org.jenkins-ci.main:jenkins-core` Maven	before 2.204.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437	2.204.2
`org.jenkins-ci.main:jenkins-core` Maven	2.205 up to 2.219, plus listed versions 2.2062.2072.2082.2092.210 Show 8 moreShow less 2.2112.2122.2132.2142.2152.2162.2172.218	2.219
`atomic-enterprise-service-catalog` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 1:3.11.170-1.git.1.91db82e.el7	1:3.11.170-1.git.1.91db82e.el7
`atomic-enterprise-service-catalog-svcat` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 1:3.11.170-1.git.1.91db82e.el7	1:3.11.170-1.git.1.91db82e.el7
`atomic-openshift` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-clients` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7

Show 41 moreShow less

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-2104 is a medium vulnerability (CVSS 4.3) in Jenkins, published January 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.204.2.

References

Show 53 moreShow less

This page doesn't list everything

Left out here: 530 versions. The JSON record has them.

Package	Affected	Fixed
`atomic-openshift-cluster-autoscaler` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.0a0df6a.el7	0:3.11.170-1.git.1.0a0df6a.el7
`atomic-openshift-descheduler` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.9ad83f2.el7	0:3.11.170-1.git.1.9ad83f2.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-dockerregistry` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.55fab05.el7	0:3.11.170-1.git.1.55fab05.el7
`atomic-openshift-excluder` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-hyperkube` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-hypershift` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-master` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-metrics-server` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.357f177.el7	0:3.11.170-1.git.1.357f177.el7
`atomic-openshift-node` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-node-problem-detector` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.b1f90a6.el7	0:3.11.170-1.git.1.b1f90a6.el7
`atomic-openshift-pod` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-service-idler` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.8328979.el7	0:3.11.170-1.git.1.8328979.el7
`atomic-openshift-template-service-broker` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-tests` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-web-console` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.3d64e8b.el7	0:3.11.170-1.git.1.3d64e8b.el7
`cri-o` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7	0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7
`cri-o-debuginfo` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7	0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7
`golang-github-openshift-oauth-proxy` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.b49be83.el7	0:3.11.170-1.git.1.b49be83.el7
`golang-github-prometheus-alertmanager` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.61d7960.el7	0:3.11.170-1.git.1.61d7960.el7
`golang-github-prometheus-node_exporter` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.51473b7.el7	0:3.11.170-1.git.1.51473b7.el7
`golang-github-prometheus-prometheus` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.227bc98.el7	0:3.11.170-1.git.1.227bc98.el7
`jenkins` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:2.204.2.1580891656-1.el7	0:2.204.2.1580891656-1.el7
`jenkins-2-plugins` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.1579107288-1.el7	0:3.11.1579107288-1.el7
`openshift-ansible` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-ansible-docs` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-ansible-playbooks` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-ansible-roles` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-ansible-test` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-enterprise-autoheal` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.dfe6c52.el7	0:3.11.170-1.git.1.dfe6c52.el7
`openshift-enterprise-cluster-capacity` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.661684b.el7	0:3.11.170-1.git.1.661684b.el7
`openshift-kuryr` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`openshift-kuryr-cni` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`openshift-kuryr-common` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`openshift-kuryr-controller` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`prometheus` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.227bc98.el7	0:3.11.170-1.git.1.227bc98.el7
`prometheus-alertmanager` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.61d7960.el7	0:3.11.170-1.git.1.61d7960.el7
`prometheus-node-exporter` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.51473b7.el7	0:3.11.170-1.git.1.51473b7.el7
`python2-kuryr-kubernetes` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`jenkins` Red Hat:openshift:4.3::el7 From an advisory covering 7 CVEs	before 0:2.204.2.1583446818-1.el7	0:2.204.2.1583446818-1.el7