CVE-2020-2155

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins OpenShift Deployer Plugin	>= unspecified, <= 1.2.0

References

http://www.openwall.com/lists/oss-security/2020/03/09/1Third Party Advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1518Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/03/09/1Third Party Advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1518Vendor Advisory

Timeline

Published: Mar 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-215548.1A File Deletion vulnerability exists in TinyShop 3.1.1 in the back_list parameter in controllers\admin.php, which could let a malicious user CVE-2020-21564.3Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially r CVE-2020-215648.8An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution CVE-2020-21574.3Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potential CVE-2020-215727.5Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, a CVE-2020-215735.5An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted i CVE-2020-215747.5Buffer overflow vulnerability in YotsuyaNight c-http v0.1.0, allows attackers to cause a denial of service via a long url request which is p CVE-2020-21588.8Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a r CVE-2020-215836.7An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path paramet CVE-2020-215859.8Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module.CVE-2020-215885.5Buffer overflow in Core FTP LE v2.2 allows local attackers to cause a denial or service (crash) via a long string in the Setup->Users->Usern CVE-2020-21598.8Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins mast