Medium severity4.3NVD Advisory· Published Apr 16, 2020· Updated Jun 17, 2026

CVE-2020-2177

Description

Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.fedoraproject.jenkins.plugins:coprMaven	< 0.6.1	0.6.1

Affected products

Jenkins Project/Copr
cpe:2.3:a:jenkins:copr:*:*:*:*:*:jenkins:*:*
Range: <=0.3
ghsa-coords
pkg:maven/org.fedoraproject.jenkins.plugins/copr
Range: < 0.6.1
Jenkins Project/MATLAB Plugincpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2020/04/16/4nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-4wx5-c723-xvwvghsaADVISORY
jenkins.io/security/advisory/2020-04-16/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-2177ghsaADVISORY
github.com/jenkinsci/copr-plugin/commit/23ea581364d64645cd90d2c5d97a4b94781f61f9ghsaWEB

News mentions

Jenkins Security Advisory 2020-04-16
Jenkins Security Advisories · Apr 16, 2020

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000