CVE-2020-2249

3.3 lowEPSS 0.3%

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

Severity

CVSS 3.1

3.3 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-311
Published: 2020-09-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:team_foundation_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-w6c2-jrhh-jrxg	Maven	org.jenkins-ci.plugins:tfs	<=5.157.1	no fix published

References

http://www.openwall.com/lists/oss-security/2020/09/01/3
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506
http://www.openwall.com/lists/oss-security/2020/09/01/3
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506

Check your stack JSON