CVE-2020-2156

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins DeployHub Plugin	>= unspecified, <= 8.0.14

References

http://www.openwall.com/lists/oss-security/2020/03/09/1Third Party Advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1511Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/03/09/1Third Party Advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1511Vendor Advisory

Timeline

Published: Mar 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-215648.8An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution CVE-2020-21574.3Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potential CVE-2020-215727.5Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, a CVE-2020-215735.5An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted i CVE-2020-215747.5Buffer overflow vulnerability in YotsuyaNight c-http v0.1.0, allows attackers to cause a denial of service via a long url request which is p CVE-2020-21588.8Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a r CVE-2020-215836.7An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path paramet CVE-2020-215859.8Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module.CVE-2020-215885.5Buffer overflow in Core FTP LE v2.2 allows local attackers to cause a denial or service (crash) via a long string in the Setup->Users->Usern CVE-2020-21598.8Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins mast CVE-2020-215904.3Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via CVE-2020-215946.5libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a crafted a file.