Moderate severityNVD Advisory· Published Sep 16, 2020· Updated Aug 4, 2024
CVE-2020-2278
CVE-2020-2278
Description
Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jvnet.hudson.plugins:storable-configs-pluginMaven | <= 1.0 | — |
Affected products
2- Range: unspecified
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-qv6q-4jwx-7j5cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-2278ghsaADVISORY
- www.openwall.com/lists/oss-security/2020/09/16/3ghsamailing-listx_refsource_MLISTWEB
- www.jenkins.io/security/advisory/2020-09-16/mitrex_refsource_CONFIRM
- www.jenkins.io/security/advisory/2020-09-16/ghsaWEB
News mentions
1- Jenkins Security Advisory 2020-09-16Jenkins Security Advisories · Sep 16, 2020