CVE-2020-2320
Jenkins Plugin Installation Manager Tool did not verify plugin downloads
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
- Record
CVE-2020-2320- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-494
- Updated
- 2026-11-02
CVE List No score
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
- Record
CVE-2020-2320- Updated
- 2026-11-02
EUVDEUVD-2022-4526 No score
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
- Record
EUVD-2022-4526- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m8r4-c7jm-w782
Jenkins Plugin Installation Manager Tool did not verify plugin downloads
Jenkins Plugin Installation Manager Tool is part of the Jenkins project Docker images. As jenkins-plugin-cli it is used to download and install plugins even before Jenkins is running.
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third parties such as mirror operators to provide crafted plugin downloads.
Jenkins Plugin Installation Manager Tool 2.2.0 confirms that actual checksums of downloaded plugin match the expected checksums.
Docker images of Jenkins 2.269 and 2.263.1 contain Plugin Installation Manager Tool 2.2.0. Users of older Docker images can change the version they use by extending the Jenkins image and update the tool themselves with:
ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.2.0/jenkins-plugin-manager-2.2.0.jar RUN curl -fsSL ${PLUGIN_CLI_URL} -o /usr/lib/jenkins-plugin-manager.jar Jenkinsfile Runner 1.0-beta-22 Docker images also include Plugin Installation Manager Tool 2.2.0.
- Record
GHSA-m8r4-c7jm-w782- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-494
- Updated
- 2026-11-02
OSV
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
- Record
CVE-2020-2320- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-m8r4-c7jm-w782
Jenkins Plugin Installation Manager Tool did not verify plugin downloads
Jenkins Plugin Installation Manager Tool is part of the Jenkins project Docker images. As jenkins-plugin-cli it is used to download and install plugins even before Jenkins is running.
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third parties such as mirror operators to provide crafted plugin downloads.
Jenkins Plugin Installation Manager Tool 2.2.0 confirms that actual checksums of downloaded plugin match the expected checksums.
Docker images of Jenkins 2.269 and 2.263.1 contain Plugin Installation Manager Tool 2.2.0. Users of older Docker images can change the version they use by extending the Jenkins image and update the tool themselves with:
ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.2.0/jenkins-plugin-manager-2.2.0.jar RUN curl -fsSL ${PLUGIN_CLI_URL} -o /usr/lib/jenkins-plugin-manager.jar Jenkinsfile Runner 1.0-beta-22 Docker images also include Plugin Installation Manager Tool 2.2.0.
- Record
GHSA-m8r4-c7jm-w782- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-494
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.plugin-management:plugin-management-parent-pomMaven |
before 2.2.0 | 2.2.0 |
io.jenkins.plugin-management:plugin-management-parent-pomMaven |
before 2.2.0, plus listed versions 0.1-alpha-100.1-alpha-110.1-alpha-120.1-alpha-130.1-alpha-14 Show 14 moreShow less0.1-alpha-151.01.0.11.0.21.1.01.1.21.2.02.0.02.0.0-beta-12.0.12.1.02.1.12.1.22.1.3 |
2.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2320 is a critical vulnerability (CVSS 9.8) in Jenkins Installation Manager Tool, published December 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in io.jenkins.plugin-management:plugin-management-parent-pom 2.2.0.
References
jenkins.io/security/advisory/2020-12-03
openwall.com/lists/oss-security/2020/12/03/2
nvd.nist.gov/vuln/detail/CVE-2020-2320
github.com/jenkinsci/plugin-installation-manager-tool/commit/dfc745c3a97a3fea74a3fe2e92d8a4440cbbf867