CVE-2020-2278

CVE-2020-2278: vulnerability in Jenkins Storable Configs Plugin

Published · Updated

Follow this CVE+ Monitor Jenkins Storable Configs Plugin+ Monitor org.jvnet.hudson.plugins:storable-configs-plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.4%
Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content.
Affected products
Jenkins project · Jenkins Storable Configs Plugin
Related CVEs — Jenkins Storable Configs Plugin

In the same product, most dangerous first.

CVE-2020-2277—CVE-2020-2277EPSS 1.7%CVE-2022-30971—CVE-2022-30971EPSS 1.3%CVE-2022-30972—CVE-2022-30972EPSS 0.7%