← All advisories

Critical severity9.8NVD Advisory· Published Dec 3, 2020· Updated Jun 17, 2026

CVE-2020-2320

CVE-2020-2320

Description

Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.jenkins.plugin-management:plugin-management-parent-pomMaven	< 2.2.0	2.2.0

Affected products

3

ghsa-coords
pkg:maven/io.jenkins.plugin-management/plugin-management-parent-pom
Range: < 2.2.0
Jenkins Project/Plugin Installation Manager Toolcpe-rescue
Range: unspecified
Jenkins Project/Installation Manager Tool
cpe:2.3:a:jenkins:installation_manager_tool:*:*:*:*:*:jenkins:*:*
Range: <=2.1.3

Patches

Vulnerability mechanics

References

5

www.openwall.com/lists/oss-security/2020/12/03/2nvdThird Party AdvisoryWEB
github.com/advisories/GHSA-m8r4-c7jm-w782ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-2320ghsaADVISORY
www.jenkins.io/security/advisory/2020-12-03/nvdVendor AdvisoryWEB
github.com/jenkinsci/plugin-installation-manager-tool/commit/dfc745c3a97a3fea74a3fe2e92d8a4440cbbf867ghsaWEB

News mentions

1

Jenkins Security Advisory 2020-12-03
Jenkins Security Advisories · Dec 3, 2020