Medium severity4.3NVD Advisory· Published Jan 15, 2020· Updated Jun 17, 2026

CVE-2020-2095

Description

Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.redgate.plugins.redgatesqlci:redgate-sql-ciMaven	< 2.0.5	2.0.5

Affected products

ghsa-coords
pkg:maven/com.redgate.plugins.redgatesqlci/redgate-sql-ci
Range: < 2.0.5
Jenkins Project/Jenkins Redgate SQL Change Automation Pluginv5
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-x23m-8c2h-6wg7ghsaADVISORY
jenkins.io/security/advisory/2020-01-15/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-2095ghsaADVISORY
github.com/jenkinsci/redgate-sql-ci-plugin/commit/962f1770eeb1f18dfac91d12461fa6db566e769eghsaWEB

News mentions

Jenkins Security Advisory 2020-01-15
Jenkins Security Advisories · Jan 15, 2020

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000