Description
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | unspecified – ≤ 2.218, unspecified – ≤ LTS 2.204.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.204.2.1583446818-1.el7 | RHBA-2020:0675 |
| Red Hat OpenShift 3 | atomic-enterprise-service-catalog +1 | 1:3.11.170-1.git.1.91db82e.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.170-1.git.0.00cac56.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-cluster-autoscaler | 3.11.170-1.git.1.0a0df6a.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-descheduler | 3.11.170-1.git.1.9ad83f2.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-dockerregistry | 3.11.170-1.git.1.55fab05.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-metrics-server | 3.11.170-1.git.1.357f177.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-node-problem-detector | 3.11.170-1.git.1.b1f90a6.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-service-idler | 3.11.170-1.git.1.8328979.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.11.170-1.git.1.3d64e8b.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | cri-o | 1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | golang-github-openshift-oauth-proxy | 3.11.170-1.git.1.b49be83.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | jenkins | 2.204.2.1580891656-1.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1579107288-1.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | openshift-ansible +4 | 3.11.170-2.git.5.8802564.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | openshift-enterprise-autoheal | 3.11.170-1.git.1.dfe6c52.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | openshift-enterprise-cluster-capacity | 3.11.170-1.git.1.661684b.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | openshift-kuryr +4 | 3.11.170-1.git.1.7265da1.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | prometheus +1 | 3.11.170-1.git.1.227bc98.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | prometheus-alertmanager +1 | 3.11.170-1.git.1.61d7960.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | prometheus-node-exporter +1 | 3.11.170-1.git.1.51473b7.el7 | RHBA-2020:0402 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Jenkins <=2.218 - Information Disclosure http/cves/2020/CVE-2020-2103.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.205, < 2.219 | 2.219 | GHSA-4jjj-cm7q-v6hr |
| Maven | org.jenkins-ci.main:jenkins-core | < 2.204.2 | 2.204.2 | GHSA-4jjj-cm7q-v6hr |
Advisories 2
- RHBA-2020:0402 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHBA-2020:0675 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.5 packages update Red Hat Security Advisories (RHSA) · Jun 27, 2026
References
- https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1695
- [oss-security] 20200129 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list
- RHSA-2020:0681 vendor-advisory
- RHSA-2020:0683 vendor-advisory
- RHBA-2020:0402 vendor-advisory
- RHBA-2020:0675 vendor-advisory