CVE-2020-2160
Cross-Site Request Forgery in Jenkins
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
CVE-2020-2160- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
CVE-2020-2160- Updated
- 2026-11-02
EUVDEUVD-2022-3520 No score
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
EUVD-2022-3520- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c735-g9f2-2mvp
Cross-Site Request Forgery in Jenkins
An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.
Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.
Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.
In case of problems, administrators can disable this security fix by setting the system property hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO to true.
As an additional safeguard, semicolon (;) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath to true.
- Record
GHSA-c735-g9f2-2mvp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352, CWE-435
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-2160
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
ALPINE-CVE-2020-2160- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
CVE-2020-2160- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-c735-g9f2-2mvp
Cross-Site Request Forgery in Jenkins
An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.
Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.
Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.
In case of problems, administrators can disable this security fix by setting the system property hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO to true.
As an additional safeguard, semicolon (;) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath to true.
- Record
GHSA-c735-g9f2-2mvp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352, CWE-435
- Updated
- 2026-11-02
OSVRHBA-2020:2435
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.25 packages update
- Record
RHBA-2020:2435- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHBA-2020:2444
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.8 packages update
- Record
RHBA-2020:2444- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHBA-2020:2477
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update
- Record
RHBA-2020:2477- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-jenkins-2020-2160 No score
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
- Record
BIT-jenkins-2020-2160- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
through 2.204.5 | 2.204.6 |
org.jenkins-ci.main:jenkins-coreMaven |
2.205 to 2.227 | 2.228 |
jenkinsAlpine:v3.11 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.12 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.13 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.14 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.15 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.16 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.17 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.18 |
before 2.228-r0 | 2.228-r0 |
Show 90 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jenkinsAlpine:v3.19 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.20 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.21 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.22 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.23 |
before 2.228-r0 | 2.228-r0 |
jenkinsAlpine:v3.24 |
before 2.228-r0 | 2.228-r0 |
jenkinsBitnami |
before 2.227.1 | 2.227.1 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.204.6, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.204.6 |
org.jenkins-ci.main:jenkins-coreMaven |
2.205 up to 2.228, plus listed versions 2.2062.2072.2082.2092.210 Show 20 moreShow less2.2112.2122.2132.2142.2152.2162.2172.2182.2192.2202.2212.2222.222.12.222.32.222.42.2232.2242.2252.2262.227 |
2.228 |
atomic-enterprise-service-catalogRed Hat:openshift:4.3::el7 |
before 1:4.3.25-202006081518.git.1.52b3a66.el7 | 1:4.3.25-202006081518.git.1.52b3a66.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:4.3::el7 |
before 1:4.3.25-202006081518.git.1.52b3a66.el7 | 1:4.3.25-202006081518.git.1.52b3a66.el7 |
atomic-openshift-service-idlerRed Hat:openshift:4.3::el7 |
before 0:4.3.25-202006081518.git.1.79365c5.el7 | 0:4.3.25-202006081518.git.1.79365c5.el7 |
conmonRed Hat:openshift:4.3::el7 |
before 2:2.0.17-1.rhaos4.3.el7 | 2:2.0.17-1.rhaos4.3.el7 |
cri-oRed Hat:openshift:4.3::el7 |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 |
cri-o-debuginfoRed Hat:openshift:4.3::el7 |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 |
jenkinsRed Hat:openshift:4.3::el7 |
before 0:2.222.1.1591349991-1.el7 | 0:2.222.1.1591349991-1.el7 |
openshiftRed Hat:openshift:4.3::el7 |
before 0:4.3.25-202006060952.git.1.96c30f6.el7 | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
openshift-ansibleRed Hat:openshift:4.3::el7 |
before 0:4.3.25-202006060952.git.1.1253fde.el7 | 0:4.3.25-202006060952.git.1.1253fde.el7 |
openshift-ansible-testRed Hat:openshift:4.3::el7 |
before 0:4.3.25-202006060952.git.1.1253fde.el7 | 0:4.3.25-202006060952.git.1.1253fde.el7 |
openshift-clientsRed Hat:openshift:4.3::el7 |
before 0:4.3.25-202006060952.git.1.fd93102.el7 | 0:4.3.25-202006060952.git.1.fd93102.el7 |
openshift-clients-redistributableRed Hat:openshift:4.3::el7 |
before 0:4.3.25-202006060952.git.1.fd93102.el7 | 0:4.3.25-202006060952.git.1.fd93102.el7 |
openshift-hyperkubeRed Hat:openshift:4.3::el7 |
before 0:4.3.25-202006060952.git.1.96c30f6.el7 | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
conmonRed Hat:openshift:4.3::el8 |
before 2:2.0.17-1.rhaos4.3.el8 | 2:2.0.17-1.rhaos4.3.el8 |
cri-oRed Hat:openshift:4.3::el8 |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
cri-o-debuginfoRed Hat:openshift:4.3::el8 |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
cri-o-debugsourceRed Hat:openshift:4.3::el8 |
before 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
machine-config-daemonRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006081518.git.1.478b31a.el8 | 0:4.3.25-202006081518.git.1.478b31a.el8 |
openshiftRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006060952.git.1.96c30f6.el8 | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
openshift-clientsRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006060952.git.1.fd93102.el8 | 0:4.3.25-202006060952.git.1.fd93102.el8 |
openshift-clients-redistributableRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006060952.git.1.fd93102.el8 | 0:4.3.25-202006060952.git.1.fd93102.el8 |
openshift-hyperkubeRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006060952.git.1.96c30f6.el8 | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
openshift-kuryrRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
openshift-kuryr-cniRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
openshift-kuryr-commonRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
openshift-kuryr-controllerRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
python3-kuryr-kubernetesRed Hat:openshift:4.3::el8 |
before 0:4.3.25-202006081518.git.1.240b401.el8 | 0:4.3.25-202006081518.git.1.240b401.el8 |
s390utilsRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-baseRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-base-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cmsfsRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cmsfs-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cmsfs-fuseRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cmsfs-fuse-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cpacfstatsdRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cpacfstatsd-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cpuplugdRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-cpuplugd-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-debugsourceRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-develRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-hmcdrvfsRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-hmcdrvfs-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-iucvtermRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-iucvterm-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-mon_statdRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-mon_statd-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-osasnmpdRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-osasnmpd-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-zdsfsRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-zdsfs-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-ziomonRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
s390utils-ziomon-debuginfoRed Hat:openshift:4.3::el8 |
before 2:2.6.0-23.el8 | 2:2.6.0-23.el8 |
atomic-enterprise-service-catalogRed Hat:openshift:4.4::el7 |
before 1:4.4.0-202006080017.git.1.77a5cc9.el7 | 1:4.4.0-202006080017.git.1.77a5cc9.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:4.4::el7 |
before 1:4.4.0-202006080017.git.1.77a5cc9.el7 | 1:4.4.0-202006080017.git.1.77a5cc9.el7 |
atomic-openshift-service-idlerRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202006080017.git.1.7e463c3.el7 | 0:4.4.0-202006080017.git.1.7e463c3.el7 |
conmonRed Hat:openshift:4.4::el7 |
before 2:2.0.17-1.rhaos4.4.el7 | 2:2.0.17-1.rhaos4.4.el7 |
cri-oRed Hat:openshift:4.4::el7 |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 |
cri-o-debuginfoRed Hat:openshift:4.4::el7 |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 |
jenkinsRed Hat:openshift:4.4::el7 |
before 0:2.222.1.1591351066-1.el7 | 0:2.222.1.1591351066-1.el7 |
openshiftRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202006061254.git.1.dc84fb4.el7 | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
openshift-ansibleRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202006061254.git.1.a996454.el7 | 0:4.4.0-202006061254.git.1.a996454.el7 |
openshift-ansible-testRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202006061254.git.1.a996454.el7 | 0:4.4.0-202006061254.git.1.a996454.el7 |
openshift-clientsRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202006061254.git.1.26cb6dc.el7 | 0:4.4.0-202006061254.git.1.26cb6dc.el7 |
openshift-clients-redistributableRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202006061254.git.1.26cb6dc.el7 | 0:4.4.0-202006061254.git.1.26cb6dc.el7 |
openshift-hyperkubeRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202006061254.git.1.dc84fb4.el7 | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
conmonRed Hat:openshift:4.4::el8 |
before 2:2.0.17-1.rhaos4.4.el8 | 2:2.0.17-1.rhaos4.4.el8 |
cri-oRed Hat:openshift:4.4::el8 |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
cri-o-debuginfoRed Hat:openshift:4.4::el8 |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
cri-o-debugsourceRed Hat:openshift:4.4::el8 |
before 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
machine-config-daemonRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006080017.git.1.32e0736.el8 | 0:4.4.0-202006080017.git.1.32e0736.el8 |
openshiftRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006061254.git.1.dc84fb4.el8 | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
openshift-clientsRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006061254.git.1.26cb6dc.el8 | 0:4.4.0-202006061254.git.1.26cb6dc.el8 |
openshift-clients-redistributableRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006061254.git.1.26cb6dc.el8 | 0:4.4.0-202006061254.git.1.26cb6dc.el8 |
openshift-hyperkubeRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006061254.git.1.dc84fb4.el8 | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
openshift-kuryrRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
openshift-kuryr-cniRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
openshift-kuryr-commonRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
openshift-kuryr-controllerRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
python3-kuryr-kubernetesRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202006080017.git.1.855ef1d.el8 | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
jenkinsRed Hat:openshift:3.11::el7 |
before 0:2.222.1.1591351669-1.el7 | 0:2.222.1.1591351669-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2160 is a high vulnerability (CVSS 8.8) in Jenkins, published March 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.204.6.
References
jenkins.io/security/advisory/2020-03-25
openwall.com/lists/oss-security/2020/03/25/2
nvd.nist.gov/vuln/detail/CVE-2020-2160
github.com/jenkinsci/jenkins/commit/f7cf28355973df1ca6eb19066370bf70b10742f7
Show 41 moreShow less
security.alpinelinux.org/vuln/CVE-2020-2160
access.redhat.com/errata/RHBA-2020:2435
bugzilla.redhat.com/show_bug.cgi?id=1843457
security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_2435.json
cve.org/CVERecord?id=CVE-2020-2160
Left out here: 534 versions. The JSON record has them.