CVE-2020-2102 : Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

Published 2020-01-29 16:15:12

Updated 2023-10-25 18:16:29

Source Jenkins Project

View at NVD, CVE.org

Threat overview for CVE-2020-2102

Top countries where our scanners detected CVE-2020-2102

Top open port discovered on systems with this issue 80

IPs affected by CVE-2020-2102 8,697

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-2102!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Probability of exploitation activity in the next 30 days: 0.14%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 50 % EPSS Score History EPSS FAQ

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.5	LOW	AV:N/AC:M/Au:S/C:P/I:N/A:N	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N	1.6	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Assigned by: nvd@nist.gov (Primary)
CWE-208 Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Assigned by: jenkinsci-cert@googlegroups.com (Secondary)

Jenkins » Jenkins » LTS Edition
Versions up to, including, (<=) 2.204.1
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
Matching versions
Jenkins » Jenkins »
Versions up to, including, (<=) 2.218
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*
Matching versions