← Vulnerability feed

Vulnerability record · CVE-2020-2149 · published 9 March 2020

CVE-2020-2149: Jenkins repository connector cleartext transmission vulnerability

Jenkins · Repository Connector

Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

5.3 CVSS 3.1 Medium EPSS 0.61% · top 52.7% CWE-319 · Cleartext transmission
5.3CVSS 3.1 base score, v2 5.0
0.61%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2020/03/09/1 Third Party Advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1520 Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/03/09/1 Third Party Advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1520 Vendor Advisory

Track CVE-2020-2149 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2019-1003038Jenkins repository connector insufficiently protected credentials vulnerabilityAn insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/huds…EPSS 0.39%5.4CVE-2022-34195Jenkins repository connector cross-site scripting vulnerabilityJenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displ…EPSS 0.80%5.4CVE-2021-21618Jenkins Repository Connector Plugin stored XSS via unescaped parameter namesJenkins Repository Connector Plugin 2.0.2 and earlier fails to escape parameter names and descriptions for past builds, creating a stored cross-site …EPSS 82%analysed4.3CVE-2022-36903Jenkins repository connector missing authorization vulnerabilityA missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate creden…EPSS 0.68%4.3CVE-2022-36904Jenkins repository connector missing authorization vulnerabilityJenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attacker…EPSS 0.68%

Source: NIST National Vulnerability Database (record CVE-2020-2149), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.