CVE-2020-2196

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Selenium Plugin	>= unspecified, <= 3.141.59

References

http://www.openwall.com/lists/oss-security/2020/06/03/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/14/2Mailing List
https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/06/03/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/14/2Mailing List
https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766Vendor Advisory

Timeline

Published: Jun 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-219674.8File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file pa CVE-2020-21974.3Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Pro CVE-2020-219768.8An arbitrary file upload in the <input type="file" name="user_image"> component of NewsOne CMS v1.1.0 allows attackers to webshell and execu CVE-2020-21986.5Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting CVE-2020-219876.1HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS). XSS vulnerabilities occur when input passed via several parameter CVE-2020-219898.8HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF). The application interface allows users to perform certain actions via CVE-2020-21996.1Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form vali CVE-2020-219907.5Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to imp CVE-2020-219919.8AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin CVE-2020-219928.8Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. The issue exist due t CVE-2020-219936.1In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the us CVE-2020-219949.8AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a requ