Vulnerability Details : CVE-2020-2287
Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web framework uses for dispatching requests, which allows attackers to craft URLs that bypass request logging of any target URL.
Exploit prediction scoring system (EPSS) score for CVE-2020-2287
Probability of exploitation activity in the next 30 days: 0.09%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 35 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2020-2287
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
References for CVE-2020-2287
-
http://www.openwall.com/lists/oss-security/2020/10/08/5
oss-security - Multiple vulnerabilities in Jenkins pluginsThird Party Advisory
-
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1815
Jenkins Security Advisory 2020-10-08Vendor Advisory
Products affected by CVE-2020-2287
- cpe:2.3:a:jenkins:audit_trail:*:*:*:*:*:jenkins:*:*