CVE-2020-2099

—

CVSS 3.1

8.6 high

EPSS

1%p61

Published

Jan 29, 2020 (Jan 29, 2020)

Modified

Jun 17, 2026

Description

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

Vendors: jenkins
Products: jenkins
Weakness: CWE-330
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.