CVE-2020-2275

MEDIUM

Jenkins Copy data to workspace Plugin <1.0 - Info Disclosure

Title source: llm
STIX 2.1

Description

Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller.

References (2)

Core 2
Core References
Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/09/16/3

Scores

CVSS v3 6.5
EPSS 0.0151
EPSS Percentile 81.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (2)
jenkins/copy_data_to_workspace < 1.0
org.jvnet.hudson.plugins/copy-data-to-workspace-plugin 0Maven
Published Sep 16, 2020
Tracked Since Feb 18, 2026