CVE-2020-2268

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins MongoDB Plugin	>= unspecified, <= 1.3

References

http://www.openwall.com/lists/oss-security/2020/09/16/3Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1904Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/09/16/3Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1904Vendor Advisory

Timeline

Published: Sep 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-22695.4Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-s CVE-2020-22705.4Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site s CVE-2020-22715.4Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripti CVE-2020-227195.4Shimo Document v2.0.1 contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML vi CVE-2020-22724.3A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attac CVE-2020-227217.8A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary code via the Miscella CVE-2020-227227.8Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe executable file. An CVE-2020-227236.1A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers CVE-2020-227249.8A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER CVE-2020-22734.3A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-sp CVE-2020-227324.8CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..CVE-2020-22745.5Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller