CVE-2020-2288

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Audit Trail Plugin	>= unspecified, <= 3.6

References

http://www.openwall.com/lists/oss-security/2020/10/08/5Third Party Advisory
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1846Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/10/08/5Third Party Advisory
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1846Vendor Advisory

Timeline

Published: Oct 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-228827.5Issue was discovered in the fxParserTree function in moddable, allows attackers to cause denial of service via a crafted payload. Fixed in c CVE-2020-228849.8Buffer overflow vulnerability in function jsvGetStringChars in Espruino before RELEASE_2V09, allows remote attackers to execute arbitrary co CVE-2020-228857.5Buffer overflow vulnerability in mujs before 1.0.8 due to recursion in the GC scanning phase, allows remote attackers to cause a denial of s CVE-2020-228867.5Buffer overflow vulnerability in function jsG_markobject in jsgc.c in mujs before 1.0.8, allows remote attackers to cause a denial of servic CVE-2020-22895.4Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site CVE-2020-22905.4Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, res CVE-2020-229077.5Stack overflow vulnerability in function jsi_evalcode_sub in jsish before 3.0.18, allows remote attackers to cause a Denial of Service via a CVE-2020-22913.3Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins con CVE-2020-229165.5An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes CVE-2020-22925.4Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (CVE-2020-22936.5Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller.CVE-2020-229379.8A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious c