CVE-2020-2196
Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection
Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.
- Record
CVE-2020-2196- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.
- Record
CVE-2020-2196- Updated
- 2026-11-02
EUVDEUVD-2022-5205 No score
Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.
- Record
EUVD-2022-5205- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rp4x-xpgf-4xv7
Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection
Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints.
This allows attackers to perform the following actions:
- Restart the Selenium Grid hub.
- Delete or replace the plugin configuration.
- Start, stop, or restart Selenium configurations on specific nodes.
Through carefully chosen configuration parameters, these actions can result in OS command injection on the Jenkins controller.
- Record
GHSA-rp4x-xpgf-4xv7- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.
- Record
CVE-2020-2196- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rp4x-xpgf-4xv7
Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection
Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints.
This allows attackers to perform the following actions:
- Restart the Selenium Grid hub.
- Delete or replace the plugin configuration.
- Start, stop, or restart Selenium configurations on specific nodes.
Through carefully chosen configuration parameters, these actions can result in OS command injection on the Jenkins controller.
- Record
GHSA-rp4x-xpgf-4xv7- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:seleniumMaven |
through 3.141.59 | None known |
org.jenkins-ci.plugins:seleniumMaven |
through 3.141.59, plus listed versions 1.41.52.02.12.2 Show 8 moreShow less2.32.42.4.12.53.02.53.13.1.03.12.03.7.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2196 is a high vulnerability (CVSS 8.0) in Jenkins Selenium, published June 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. No source names a fixed version.