{"id":"CVE-2020-2239","aliases":["EUVD-2022-5614","GHSA-wphq-j78p-fhgp"],"status":"published","title":"Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin","description":"Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00524,"percentile":0.44729,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-256","CWE-311"],"published":"2020-09-01T13:50:30Z","modified":"2026-10-24T10:30:30Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:Parameterized-Remote-Trigger","fixed_in":["3.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:Parameterized-Remote-Trigger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.3"},{"fixed":"3.1.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:Parameterized-Remote-Trigger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4"}]}],"versions":["1.1","2.0","2.1","2.1.3","2.2.2","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3"]}],"products":[{"vendor":"jenkins","product":"parameterized_remote_trigger"},{"vendor":"jenkins project","product":"jenkins parameterized remote trigger plugin"}],"references":[{"url":"https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1625","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2020/09/01/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2239","tags":["advisory"]},{"url":"https://github.com/jenkinsci/parameterized-remote-trigger-plugin/commit/2902ef5ea6eb077f43fd25c880e4920faea4e828","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wphq-j78p-fhgp"},{"url":"https://github.com/jenkinsci/parameterized-remote-trigger-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-2239","description":"Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.","status":"published","published":"2020-09-01T13:50:30Z","modified":"2024-08-04T07:01:41.273Z","updated_at":"2026-11-02T14:35:51.206854Z"}],"euvd":[{"id":"EUVD-2022-5614","description":"Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.","status":"published","published":"2020-09-01T13:50:30Z","modified":"2024-08-04T07:01:41Z","updated_at":"2026-11-03T03:08:09.929524Z"}],"ghsa":[{"id":"GHSA-wphq-j78p-fhgp","title":"Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin","description":"Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file `org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml` on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.\n\nParameterized Remote Trigger Plugin 3.1.4 stores the secret encrypted once its configuration is saved again.","status":"published","published":"2022-05-24T17:27:06Z","modified":"2023-12-07T21:43:56Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-256","CWE-311"],"updated_at":"2026-11-02T14:37:24.593982Z"}],"nvd":[{"id":"CVE-2020-2239","description":"Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.","status":"published","published":"2020-09-01T14:15:12.627Z","modified":"2026-06-17T03:12:03.21Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-311"],"updated_at":"2026-11-02T14:06:13.600965Z"}],"osv":[{"id":"CVE-2020-2239","description":"Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.","status":"published","published":"2020-09-01T14:15:12.627Z","modified":"2026-10-24T10:30:30.549781968Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"GHSA-wphq-j78p-fhgp","title":"Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin","description":"Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file `org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml` on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.\n\nParameterized Remote Trigger Plugin 3.1.4 stores the secret encrypted once its configuration is saved again.","status":"published","published":"2022-05-24T17:27:06Z","modified":"2024-02-16T08:11:03.063755Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-256","CWE-311"],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}