Skip to content
Fencer Vulns
medium 4.3

CVE-2020-2307 json

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin

published 2020-11-04 6 y ago modified 2026-06-17 4 mo ago also GHSA-fh5w-p2j4-4p8x , EUVD-2022-3783

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.

Patch / fix

  • maven org.csanchez.jenkins.plugins:kubernetes 1.21.6, 1.25.4.1, 1.26.5, 1.27.4
  • Jenkins project Jenkins Kubernetes Plugin 1.21.6, 1.25.4.1, 1.26.5
  • python-urllib3 openshift 4.5 1.26.2-1.el7
  • python2-urllib3 openshift 4.5 1.26.2-1.el7
  • jenkins-2-plugins openshift 4.5 4.5.1610108899-1.el7
  • jenkins openshift 3.11 2.263.3.1612433584-1.el7
  • python-rsa openshift 3.11 4.5-3.el7
  • python2-rsa openshift 3.11 4.5-3.el7
  • jenkins-2-plugins openshift 3.11 3.11.1612862361-1.el7
  • cri-o openshift 4.6 1.19.1-2.rhaos4.6.git2af9ecf.el8

red hat advisories RHSA-2021:0034RHSA-2021:0637RHSA-2021:0038

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-2307 updated cvss 4.3

jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin

  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins 3.11.1612862361-1.el7
    fixed: vendor fix RHSA-2021:0637
  • Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins 4.5.1610108899-1.el7
    fixed: vendor fix RHSA-2021:0034
  • Red Hat OpenShift Container Platform 4.6 jenkins-2-plugins 4.6.1608634578-1.el7, jenkins-2-plugins 4.6.1609853716-1.el8
    fixed: vendor fix RHSA-2021:0038
  • Red Hat OpenShift Container Platform 3.11 haproxy 1.8.28-1.el7, python-rsa 4.5-3.el7, python2-rsa 4.5-3.el7, haproxy18 1.8.28-1.el7, jenkins 2.263.3.1612433584-1.el7, prometheus 3.11.394-1.git.5026.2c9627f.el7, +39 more Red Hat OpenShift Container Platform 4.5 python-urllib3 1.26.2-1.el7, python2-urllib3 1.26.2-1.el7, cri-o 1.18.4-5.rhaos4.5.gitd655863.el7, cri-o 1.18.4-5.rhaos4.5.gitd655863.el8, openshift 4.5.0-202012221738.p0.git.0.9c544e4.el7, openshift 4.5.0-202012221738.p0.git.0.9c544e4.el8, +8 more Red Hat OpenShift Container Platform 4.6 cri-o 1.19.1-2.rhaos4.6.git2af9ecf.el8, console-login-helper-messages 0.20.3-1.rhaos4.6.el8, openshift 4.6.0-202012190744.p0.git.94235.c62c6f7.el7, openshift 4.6.0-202012190744.p0.git.94235.c62c6f7.el8, openshift-ansible 4.6.0-202012172338.p0.git.0.a15d08c.el7, openshift-kuryr 4.6.0-202012171504.p0.git.2216.1fecf92.el8, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.csanchez.jenkins.plugins:kubernetes
>=1.27.0, <1.27.4
>=1.26.0, <1.26.5
>=1.22.0, <1.25.4.1
<1.21.6
1.27.4
1.26.5
1.25.4.1
1.21.6

Affected products

  • Jenkins project Jenkins Kubernetes Plugin

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.