CVE-2020-2160

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

Published: Mar 25, 2020
Updated: Oct 26, 2023
CVE: CVE-2020-2160
GHSA: GHSA-c735-g9f2-2mvp
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-435
CWE-352

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.204.5.x
jenkins / jenkins	-	2.227.x
org.jenkins-ci.main / jenkins-core	-	2.228
org.jenkins-ci.main / jenkins-core	2.204.6	2.228

http://www.openwall.com/lists/oss-security/2020/03/25/2
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774

Vulnerability Database

289,599

CVE-2020-2160