VDB
CVE-2020-2099
CVE-2020-2099
PUBLISHED
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.
EPSS 0.64% · 71.1th percentile
Risk Scores
EPSS Score
0.64%
71.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | jenkins | 0 |
| Bitnami | jenkins | 0 |
Exploit Intelligence
Timeline
- Jan 29, 2020 CVE Published
- Mar 17, 2020 CVE Updated
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- http://www.openwall.com/lists/oss-security/2020/01/29/1 url
- https://access.redhat.com/errata/RHBA-2020:0402 url
- https://access.redhat.com/errata/RHBA-2020:0675 url
- https://access.redhat.com/errata/RHSA-2020:0681 url
- https://access.redhat.com/errata/RHSA-2020:0683 url
- https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1682 url
- https://nvd.nist.gov/vuln/detail/CVE-2020-2099 url