CVE-2020-2099

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized…

published January 29, 2020

CVSS
—
EPSS
1%
Percentile
62.9
In the wild
Unconfirmed
What it is

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01012 · 62.9th percentile
Published
2020-01-29T15:15Z
EPSS history
Timeline
  • 29 JAN 15:15Z
    Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized…
    cvelistv5