Medium severity5.3NVD Advisory· Published Mar 9, 2020· Updated Jun 17, 2026

CVE-2020-2143

Description

Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:logstashMaven	< 2.3.2	2.3.2

Affected products

Jenkins Project/Logstash
cpe:2.3:a:jenkins:logstash:*:*:*:*:*:jenkins:*:*
Range: <=2.3.1
ghsa-coords
pkg:maven/org.jenkins-ci.plugins/logstash
Range: < 2.3.2
Jenkins Project/Logstash Pluginv5
Range: unspecified

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2020/03/09/1nvdThird Party AdvisoryWEB
github.com/advisories/GHSA-5pg8-f89x-wjcxghsaADVISORY
jenkins.io/security/advisory/2020-03-09/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-2143ghsaADVISORY
github.com/jenkinsci/logstash-plugin/commit/b42d5c116473d11c79ebd2ff24e2643b9bce14d6ghsaWEB

News mentions

Jenkins Security Advisory 2020-03-09
Jenkins Security Advisories · Mar 9, 2020

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000