CVE-2020-2293 - Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller

MEDIUM

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller

Published Oct 8, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 1.01%

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
unspecified	affected	<=2.4

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/10/08/5		mailing-listx_refsource_MLISTThird Party Advisory
https://github.com/advisories/GHSA-5mfw-p6qv-wgvv		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2293
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2046		x_refsource_CONFIRMVendor Advisory