CVE-2020-2119

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Azure AD Plugin	>= unspecified, <= 1.1.2

References

http://www.openwall.com/lists/oss-security/2020/02/12/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1717Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/02/12/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1717Vendor Advisory

Timeline

Published: Feb 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-21208.8Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.CVE-2020-21218.8Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types CVE-2020-212196.1Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to r CVE-2020-21225.4Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cr CVE-2020-212249.8A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to th CVE-2020-212286.1JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitraril CVE-2020-21238.8Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a r CVE-2020-212368.8A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts CVE-2020-212379.8An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.CVE-2020-212389.8An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.CVE-2020-21244.3Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins mast CVE-2020-212444.9An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php