Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8t18-v493-jbam
Vulnerability ID VCID-8t18-v493-jbam
Aliases CVE-2020-2307
GHSA-fh5w-p2j4-4p8x
Summary Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 includes a feature to replace placeholders in pod template and container template fields with environment variable values. This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables. Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 disables this feature.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2307.json
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-2307
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-fh5w-p2j4-4p8x
cvssv3.1 4.3 https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2307.json
generic_textual MODERATE https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2307.json
cvssv3.1 4.3 https://github.com/jenkinsci/kubernetes-plugin/commit/8dadc2168b108eb45c68037fa941d2594da46d79
generic_textual MODERATE https://github.com/jenkinsci/kubernetes-plugin/commit/8dadc2168b108eb45c68037fa941d2594da46d79
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2020-2307
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-2307
cvssv3.1 4.3 https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646
generic_textual MODERATE https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2307.json
https://api.first.org/data/v1/epss?cve=CVE-2020-2307
https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2307.json
https://github.com/jenkinsci/kubernetes-plugin/commit/8dadc2168b108eb45c68037fa941d2594da46d79
https://nvd.nist.gov/vuln/detail/CVE-2020-2307
https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646
1895945 https://bugzilla.redhat.com/show_bug.cgi?id=1895945
GHSA-fh5w-p2j4-4p8x https://github.com/advisories/GHSA-fh5w-p2j4-4p8x
RHSA-2021:0034 https://access.redhat.com/errata/RHSA-2021:0034
RHSA-2021:0038 https://access.redhat.com/errata/RHSA-2021:0038
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2307.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2307.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/kubernetes-plugin/commit/8dadc2168b108eb45c68037fa941d2594da46d79
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-2307
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.24077
EPSS Score 0.00082
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:07:50.356262+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fh5w-p2j4-4p8x/GHSA-fh5w-p2j4-4p8x.json 38.0.0