CVE-2020-2203

4.3 mediumEPSS 0.7%

A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2020-07-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:fortify_on_demand

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-p364-xfp2-f9rr	Maven	org.jenkins-ci.plugins:fortify-on-demand-uploader	<6.0.0	6.0.0

References

http://www.openwall.com/lists/oss-security/2020/07/02/7
https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1691
http://www.openwall.com/lists/oss-security/2020/07/02/7
https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1691

Check your stack JSON