CVE-2020-2104 — Memory usage graphs accessible to anyone with Overall/Read

Description

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins	unspecified – ≤ 2.218, unspecified – ≤ LTS 2.204.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat OpenShift 4	jenkins	2.204.2.1583446818-1.el7	RHBA-2020:0675
Red Hat OpenShift 3	atomic-enterprise-service-catalog +1	1:3.11.170-1.git.1.91db82e.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift +12	3.11.170-1.git.0.00cac56.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-cluster-autoscaler	3.11.170-1.git.1.0a0df6a.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-descheduler	3.11.170-1.git.1.9ad83f2.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-dockerregistry	3.11.170-1.git.1.55fab05.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-metrics-server	3.11.170-1.git.1.357f177.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-node-problem-detector	3.11.170-1.git.1.b1f90a6.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-service-idler	3.11.170-1.git.1.8328979.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-web-console	3.11.170-1.git.1.3d64e8b.el7	RHBA-2020:0402
Red Hat OpenShift 3	cri-o	1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7	RHBA-2020:0402
Red Hat OpenShift 3	golang-github-openshift-oauth-proxy	3.11.170-1.git.1.b49be83.el7	RHBA-2020:0402
Red Hat OpenShift 3	jenkins	2.204.2.1580891656-1.el7	RHBA-2020:0402
Red Hat OpenShift 3	jenkins-2-plugins	3.11.1579107288-1.el7	RHBA-2020:0402
Red Hat OpenShift 3	openshift-ansible +4	3.11.170-2.git.5.8802564.el7	RHBA-2020:0402
Red Hat OpenShift 3	openshift-enterprise-autoheal	3.11.170-1.git.1.dfe6c52.el7	RHBA-2020:0402
Red Hat OpenShift 3	openshift-enterprise-cluster-capacity	3.11.170-1.git.1.661684b.el7	RHBA-2020:0402
Red Hat OpenShift 3	openshift-kuryr +4	3.11.170-1.git.1.7265da1.el7	RHBA-2020:0402
Red Hat OpenShift 3	prometheus +1	3.11.170-1.git.1.227bc98.el7	RHBA-2020:0402
Red Hat OpenShift 3	prometheus-alertmanager +1	3.11.170-1.git.1.61d7960.el7	RHBA-2020:0402
Red Hat OpenShift 3	prometheus-node-exporter +1	3.11.170-1.git.1.51473b7.el7	RHBA-2020:0402

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.main:jenkins-core	< 2.204.2	2.204.2	GHSA-r78q-qgx6-64pp
Maven	org.jenkins-ci.main:jenkins-core	>= 2.205, < 2.219	2.219	GHSA-r78q-qgx6-64pp

Advisories 2

RHBA-2020:0402 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHBA-2020:0675 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.5 packages update Red Hat Security Advisories (RHSA) · Jun 27, 2026

References

https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1650
[oss-security] 20200129 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list
RHSA-2020:0681 vendor-advisory
RHSA-2020:0683 vendor-advisory
RHBA-2020:0402 vendor-advisory
RHBA-2020:0675 vendor-advisory