← All advisories

Critical severityNVD Advisory· Published Dec 3, 2020· Updated Aug 4, 2024

CVE-2020-2320

CVE-2020-2320

Description

Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.jenkins.plugin-management:plugin-management-parent-pomMaven	< 2.2.0	2.2.0

Affected products

2

ghsa-coords
pkg:maven/io.jenkins.plugin-management/plugin-management-parent-pom
Range: < 2.2.0
Jenkins Project/Plugin Installation Manager Toolcpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

5

github.com/advisories/GHSA-m8r4-c7jm-w782ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-2320ghsaADVISORY
www.openwall.com/lists/oss-security/2020/12/03/2ghsamailing-listx_refsource_MLISTWEB
github.com/jenkinsci/plugin-installation-manager-tool/commit/dfc745c3a97a3fea74a3fe2e92d8a4440cbbf867ghsaWEB
www.jenkins.io/security/advisory/2020-12-03/ghsax_refsource_CONFIRMWEB

News mentions

1

Jenkins Security Advisory 2020-12-03
Jenkins Security Advisories · Dec 3, 2020