Jenkins Security Advisory 2020-11-04
Affects plugin: Active Directory Affects plugin: Static Analysis Utilities Affects plugin: Ansible Affects plugin: AppSpider Affects plugin: AWS Global Configuration Affects plugin: Azure Key Vault Affects plugin: FindBugs Affects plugin: Kubernetes Affects plugin: Mail Commander Plugin for Jenkins-ci Affects plugin: Mercurial Affects plugin: SQLPlus Script Runner Affects plugin: Subversion Affects plugin: Visualworks Store Affects plugin: VMware Lab Manager Slaves
CSIRTS triage
- What
- Multiple security vulnerabilities have been identified affecting various Jenkins plugins.
- Who is affected
- All deployments using the affected plugins are at risk.
- Urgency
- Remediation is necessary as vulnerabilities can lead to potential exploitation.
- Action
- Update to the latest versions of the affected Jenkins plugins.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Jenkins Plugins
Get an email when a new Jenkins Plugins advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.jenkins.io/security/advisory/2020-11-04/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2020-22991.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2020-23001.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 75% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2020-23011.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 75% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2020-23020.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2020-23030.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2020-23041.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 72% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2020-23051.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 71% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2020-23061.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 62% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2020-23071.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 66% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2020-23081.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 64% of all EPSS-scored CVEs.
Referenced CVEs
More from Jenkins Security Advisories
- unknownJenkins Security Advisory 2026-08-052026-08-05
- unknownJenkins Security Advisory 2026-06-242026-06-24
- unknownJenkins Security Advisory 2026-06-102026-06-10
- unknownJenkins Security Advisory 2026-05-272026-05-27
- unknownJenkins Security Advisory 2026-04-292026-04-29