CVE-2020-2267

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins MongoDB Plugin	>= unspecified, <= 1.3

References

http://www.openwall.com/lists/oss-security/2020/09/16/3Third Party Advisory
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1904Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/09/16/3Third Party Advisory
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1904Vendor Advisory

Timeline

Published: Sep 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-226735.5Memory leak in the senc_Parse function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service (DoS) via a crafted input.CVE-2020-226745.5An issue was discovered in gpac 0.8.0. An invalid memory dereference exists in the function FixTrackID located in isom_intern.c, which allow CVE-2020-226755.5An issue was discovered in gpac 0.8.0. The GetGhostNum function in stbl_read.c has a heap-based buffer overflow which can lead to a denial o CVE-2020-226775.5An issue was discovered in gpac 0.8.0. The dump_data_hex function in box_dump.c has a heap-based buffer overflow which can lead to a denial CVE-2020-226785.5An issue was discovered in gpac 0.8.0. The gf_media_nalu_remove_emulation_bytes function in av_parsers.c has a heap-based buffer overflow wh CVE-2020-226795.5Memory leak in the sgpd_parse_entry function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service (DoS) via a crafted input CVE-2020-22688.8A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata CVE-2020-22695.4Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-s CVE-2020-22705.4Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site s CVE-2020-22715.4Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripti CVE-2020-227195.4Shimo Document v2.0.1 contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML vi CVE-2020-22724.3A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attac