CVE-2020-2110

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Script Security Plugin	>= unspecified, <= 1.69

References

http://www.openwall.com/lists/oss-security/2020/02/12/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1713Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/02/12/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1713Vendor Advisory

Timeline

Published: Feb 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-211015.4Cross Site Scriptiong vulnerabilityin Screenly screenly-ose all versions, including v1.8.2 (2019-09-25-Screenly-OSE-lite.img), in the 'Add A CVE-2020-21115.4Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, re CVE-2020-211199.8SQL Injection vulnerability in Kliqqi-CMS 2.0.2 in admin/admin_update_module_widgets.php in recordIDValue parameter, allows attackers to gai CVE-2020-21125.4Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripti CVE-2020-211209.8SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookie_CVE-2020-211219.8Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin_update_module_widgets.php fi CVE-2020-211225.3UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.CVE-2020-211249.8UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.CVE-2020-211259.8An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.CVE-2020-211268.8MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.CVE-2020-211279.8MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.CVE-2020-21135.4Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scriptin