High severity8.8NVD Advisory· Published Apr 16, 2020· Updated Jun 17, 2026

CVE-2020-2180

Description

Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.jenkins.plugins:aws-samMaven	< 1.2.3	1.2.3

Affected products

Jenkins Project/AWS SAM Plugincpe-rescue
Range: unspecified
ghsa-coords
pkg:maven/io.jenkins.plugins/aws-sam
Range: < 1.2.3
Jenkins Project/Amazon Web Services Serverless Application Model
cpe:2.3:a:jenkins:amazon_web_services_serverless_application_model:*:*:*:*:*:jenkins:*:*
Range: <=1.2.2

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2020/04/16/4nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-qrm8-cw73-r9w8ghsaADVISORY
jenkins.io/security/advisory/2020-04-16/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-2180ghsaADVISORY
github.com/jenkinsci/aws-sam-plugin/commit/6ddcb029638b5af05df701a11139d6a6c015ab7eghsaWEB

News mentions

Jenkins Security Advisory 2020-04-16
Jenkins Security Advisories · Apr 16, 2020

cvss	0.572
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000