CVE-2020-2307
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin
4.3 MediumFix available
Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
1.08%Up 0.5 points since Apr 14, 2021
What each source reports
NVD Score used
Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
- Record
CVE-2020-2307- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
- Record
CVE-2020-2307- Updated
- 2026-11-02
EUVDEUVD-2022-3783 No score
Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
- Record
EUVD-2022-3783- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fh5w-p2j4-4p8x
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin
Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 includes a feature to replace placeholders in pod template and container template fields with environment variable values.
This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 disables this feature.
- Record
GHSA-fh5w-p2j4-4p8x- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
- Record
CVE-2020-2307- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-fh5w-p2j4-4p8x
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin
Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 includes a feature to replace placeholders in pod template and container template fields with environment variable values.
This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 disables this feature.
- Record
GHSA-fh5w-p2j4-4p8x- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVRHSA-2021:0034
Red Hat Security Advisory: OpenShift Container Platform 4.5.27 packages and security update
- Record
RHSA-2021:0034- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2021:0038
Red Hat Security Advisory: OpenShift Container Platform 4.6.12 packages and security update
- Record
RHSA-2021:0038- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0637
Red Hat Security Advisory: OpenShift Container Platform 3.11.394 bug fix and security update
- Record
RHSA-2021:0637- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.csanchez.jenkins.plugins:kubernetesMaven |
1.27.0 up to 1.27.4 | 1.27.4 |
org.csanchez.jenkins.plugins:kubernetesMaven |
1.26.0 up to 1.26.5 | 1.26.5 |
org.csanchez.jenkins.plugins:kubernetesMaven |
1.22.0 up to 1.25.4.1 | 1.25.4.1 |
org.csanchez.jenkins.plugins:kubernetesMaven |
before 1.21.6 | 1.21.6 |
org.csanchez.jenkins.plugins:kubernetesMaven |
1.27.0 up to 1.27.4, plus listed versions 1.27.11.27.1.11.27.21.27.3 |
1.27.4 |
org.csanchez.jenkins.plugins:kubernetesMaven |
1.26.0 up to 1.26.5, plus listed versions 1.26.11.26.21.26.31.26.4 |
1.26.5 |
org.csanchez.jenkins.plugins:kubernetesMaven |
1.22.0 up to 1.25.4.1, plus listed versions 1.22.11.22.21.22.31.22.41.22.5 Show 13 moreShow less1.22.61.23.01.23.11.23.21.23.31.23.41.24.01.24.11.25.01.25.11.25.21.25.31.25.4 |
1.25.4.1 |
org.csanchez.jenkins.plugins:kubernetesMaven |
before 1.21.6, plus listed versions 0.10.100.110.120.2 Show 45 moreShow less0.30.40.4.10.50.60.70.80.91.01.11.1.11.1.21.1.31.1.41.10.01.10.11.10.21.11.01.12.01.12.11.12.21.12.31.12.41.12.51.12.61.12.71.12.81.12.91.13.01.13.11.13.21.13.31.13.41.13.51.13.61.13.71.13.81.13.91.14.01.14.11.14.21.14.31.14.41.14.51.14.6 |
1.21.6 |
jenkins-2-pluginsRed Hat:openshift:4.5::el7 From an advisory covering 7 CVEs |
before 0:4.5.1610108899-1.el7 | 0:4.5.1610108899-1.el7 |
python-urllib3Red Hat:openshift:4.5::el7 From an advisory covering 7 CVEs |
before 0:1.26.2-1.el7 | 0:1.26.2-1.el7 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python2-urllib3Red Hat:openshift:4.5::el7 From an advisory covering 7 CVEs |
before 0:1.26.2-1.el7 | 0:1.26.2-1.el7 |
jenkins-2-pluginsRed Hat:openshift:4.6::el7 From an advisory covering 7 CVEs |
before 0:4.6.1608634578-1.el7 | 0:4.6.1608634578-1.el7 |
jenkins-2-pluginsRed Hat:openshift:4.6::el8 From an advisory covering 7 CVEs |
before 0:4.6.1609853716-1.el8 | 0:4.6.1609853716-1.el8 |
openshiftRed Hat:openshift:4.6::el7 From an advisory covering 7 CVEs |
before 0:4.6.0-202012190744.p0.git.94235.c62c6f7.el7 | 0:4.6.0-202012190744.p0.git.94235.c62c6f7.el7 |
openshift-clientsRed Hat:openshift:4.6::el7 From an advisory covering 7 CVEs |
before 0:4.6.0-202012172338.p0.git.3800.30af700.el7 | 0:4.6.0-202012172338.p0.git.3800.30af700.el7 |
openshift-clients-redistributableRed Hat:openshift:4.6::el7 From an advisory covering 7 CVEs |
before 0:4.6.0-202012172338.p0.git.3800.30af700.el7 | 0:4.6.0-202012172338.p0.git.3800.30af700.el7 |
openshift-hyperkubeRed Hat:openshift:4.6::el7 From an advisory covering 7 CVEs |
before 0:4.6.0-202012190744.p0.git.94235.c62c6f7.el7 | 0:4.6.0-202012190744.p0.git.94235.c62c6f7.el7 |
cri-oRed Hat:openshift:4.6::el8 From an advisory covering 7 CVEs |
before 0:1.19.1-2.rhaos4.6.git2af9ecf.el8 | 0:1.19.1-2.rhaos4.6.git2af9ecf.el8 |
cri-o-debuginfoRed Hat:openshift:4.6::el8 From an advisory covering 7 CVEs |
before 0:1.19.1-2.rhaos4.6.git2af9ecf.el8 | 0:1.19.1-2.rhaos4.6.git2af9ecf.el8 |
cri-o-debugsourceRed Hat:openshift:4.6::el8 From an advisory covering 7 CVEs |
before 0:1.19.1-2.rhaos4.6.git2af9ecf.el8 | 0:1.19.1-2.rhaos4.6.git2af9ecf.el8 |
openshiftRed Hat:openshift:4.6::el8 From an advisory covering 7 CVEs |
before 0:4.6.0-202012190744.p0.git.94235.c62c6f7.el8 | 0:4.6.0-202012190744.p0.git.94235.c62c6f7.el8 |
openshift-clientsRed Hat:openshift:4.6::el8 From an advisory covering 7 CVEs |
before 0:4.6.0-202012172338.p0.git.3800.30af700.el8 | 0:4.6.0-202012172338.p0.git.3800.30af700.el8 |
openshift-clients-redistributableRed Hat:openshift:4.6::el8 From an advisory covering 7 CVEs |
before 0:4.6.0-202012172338.p0.git.3800.30af700.el8 | 0:4.6.0-202012172338.p0.git.3800.30af700.el8 |
openshift-hyperkubeRed Hat:openshift:4.6::el8 From an advisory covering 7 CVEs |
before 0:4.6.0-202012190744.p0.git.94235.c62c6f7.el8 | 0:4.6.0-202012190744.p0.git.94235.c62c6f7.el8 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 19 CVEs |
before 0:2.263.3.1612433584-1.el7 | 0:2.263.3.1612433584-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 19 CVEs |
before 0:3.11.1612862361-1.el7 | 0:3.11.1612862361-1.el7 |
python-rsaRed Hat:openshift:3.11::el7 From an advisory covering 19 CVEs |
before 0:4.5-3.el7 | 0:4.5-3.el7 |
python2-rsaRed Hat:openshift:3.11::el7 From an advisory covering 19 CVEs |
before 0:4.5-3.el7 | 0:4.5-3.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2307 is a medium vulnerability (CVSS 4.3) in Jenkins Kubernetes, published November 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in org.csanchez.jenkins.plugins:kubernetes 1.27.4.
References
jenkins.io/security/advisory/2020-11-04
nvd.nist.gov/vuln/detail/CVE-2020-2307
github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2307.json
access.redhat.com/errata/RHSA-2021:0034
Show 103 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1883632
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0034.json
cve.org/CVERecord?id=CVE-2020-2304
security.gentoo.org/glsa/202011-18
This page doesn't list everything
Left out here: 69 versions. The JSON record has them.