CVE-2020-2212

MEDIUM

Jenkins GitHub Coverage Reporter Plugin <1.8 - Info Disclosure

Title source: llm

Description

Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system or read permissions on the system configuration.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1632

Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2020/07/02/7

Scores

CVSS v3 4.3

EPSS 0.0002

EPSS Percentile 6.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-522

Status published

Products (2)

io.jenkins.plugins/github-coverage-reporter 0Maven

jenkins/github_coverage_reporter < 1.8

Published Jul 02, 2020

Tracked Since Feb 18, 2026