Jenkins Mac vulnerabilities

3 CVEs affecting Jenkins Mac, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2148, published 2020-03-09.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-2147, published 2020-03-09. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
• CVE-2020-2148, published 2020-03-09. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
• CVE-2020-2146, published 2020-03-09. High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days. Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.