CVE-2020-2110
Improper Input Validation in Jenkins Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
- Record
CVE-2020-2110- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
- Record
CVE-2020-2110- Updated
- 2026-11-02
EUVDEUVD-2022-5037 No score
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
- Record
EUVD-2022-5037- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qvmf-36h5-3f5v
Improper Input Validation in Jenkins Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
- Record
GHSA-qvmf-36h5-3f5v- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
- Record
CVE-2020-2110- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-qvmf-36h5-3f5v
Improper Input Validation in Jenkins Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
- Record
GHSA-qvmf-36h5-3f5v- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHSA-2020:2478
Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins-2-plugins security update
- Record
RHSA-2020:2478- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2737
Red Hat Security Advisory: OpenShift Container Platform 4.4.z jenkins-2-plugins security update
- Record
RHSA-2020:2737- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3616
Red Hat Security Advisory: OpenShift Container Platform 4.3.35 jenkins-2-plugins security update
- Record
RHSA-2020:3616- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:script-securityMaven |
through 1.69 | 1.70 |
org.jenkins-ci.plugins:script-securityMaven |
before 1.70, plus listed versions 1.01.0-beta-11.0-beta-21.0-beta-31.0-beta-4 Show 45 moreShow less1.0-beta-51.0-beta-61.11.101.111.121.131.141.151.161.171.181.18.11.191.21.201.211.221.231.241.251.261.271.281.291.29.11.31.301.311.331.341.351.361.371.381.391.41.401.411.421.431.441.44.11.451.46 |
1.70 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 8 CVEs |
before 0:3.11.1591354111-1.el7 | 0:3.11.1591354111-1.el7 |
jenkins-2-pluginsRed Hat:openshift:4.4::el7 From an advisory covering 7 CVEs |
before 0:4.4.1592817009-1.el7 | 0:4.4.1592817009-1.el7 |
jenkins-2-pluginsRed Hat:openshift:4.3::el7 From an advisory covering 7 CVEs |
before 0:4.3.1597915133-1.el7 | 0:4.3.1597915133-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2110 is a high vulnerability (CVSS 8.8) in Jenkins Script Security, published February 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in org.jenkins-ci.plugins:script-security 1.70.
References
jenkins.io/security/advisory/2020-02-12
openwall.com/lists/oss-security/2020/02/12/3
nvd.nist.gov/vuln/detail/CVE-2020-2110
github.com/jenkinsci/script-security-plugin/commit/1a09bdcf789b87c4e158aacebd40937c64398de3
access.redhat.com/errata/RHSA-2020:2478
Show 40 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1819074
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2478.json
cve.org/CVERecord?id=CVE-2019-10392
Left out here: 46 versions. The JSON record has them.