Vulnerability Details : CVE-2020-2288

In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling.

Published 2020-10-08 13:15:11

Updated 2023-10-25 18:16:41

Source Jenkins Project

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-2288

Probability of exploitation activity in the next 30 days: 0.09%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 35 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2020-2288

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	nvd@nist.gov
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

References for CVE-2020-2288

https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1846

Jenkins Security Advisory 2020-10-08
Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/10/08/5

oss-security - Multiple vulnerabilities in Jenkins plugins
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2020-2288

Jenkins » Audit Trail » For Jenkins
Versions up to, including, (<=) 3.6
cpe:2.3:a:jenkins:audit_trail:*:*:*:*:*:jenkins:*:*
Matching versions