CVE-2020-2184
CSRF vulnerability in Jenkins CVS Plugin
A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
- Record
CVE-2020-2184- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
- Record
CVE-2020-2184- Updated
- 2026-11-02
EUVDEUVD-2022-2703 No score
A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
- Record
EUVD-2022-2703- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-63mw-hp3h-gc77
CSRF vulnerability in Jenkins CVS Plugin
CVS Plugin 2.15 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
CVS Plugin 2.16 now requires POST requests for the affected HTTP endpoints.
- Record
GHSA-63mw-hp3h-gc77- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
- Record
CVE-2020-2184- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-63mw-hp3h-gc77
CSRF vulnerability in Jenkins CVS Plugin
CVS Plugin 2.15 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
CVS Plugin 2.16 now requires POST requests for the affected HTTP endpoints.
- Record
GHSA-63mw-hp3h-gc77- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:cvsMaven |
through 2.15 | 2.16 |
org.jenkins-ci.plugins:cvsMaven |
before 2.16, plus listed versions 1.41.51.62.02.1 Show 14 moreShow less2.102.112.122.132.142.152.22.32.42.52.62.72.82.9 |
2.16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2184 is a medium vulnerability (CVSS 4.3) in Jenkins Project Cvs Plugin, published May 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 44.5%, the 98th percentile. Fixed in org.jenkins-ci.plugins:cvs 2.16.