CVE-2020-2249

LOW

Jenkins Team Foundation Server Plugin <5.157.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

References (2)

Scores

CVSS v3 3.3
EPSS 0.0001
EPSS Percentile 0.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-311
Status published
Products (2)
jenkins/team_foundation_server < 5.157.1
org.jenkins-ci.plugins/tfs 0Maven
Published Sep 01, 2020
Tracked Since Feb 18, 2026