CVE-2020-2160

high

Description

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

References

https://github.com/advisories/GHSA-c735-g9f2-2mvp

https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3520

http://www.openwall.com/lists/oss-security/2020/03/25/2

Details

Source: Mitre, NVD

Published: 2020-03-25

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.02043

Detections

Analytics