PT-2020-15296 · Jenkins · Jenkins Amazon Ec2 Plugin+1

Oleg Nenashev · Published 2020-01-15 · Updated 2023-10-25 · CVE-2020-2090

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Amazon EC2 Plugin versions 1.47 and earlier

Description A cross-site request forgery issue allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. The vulnerability is due to the lack of permission checks in methods performing form validation, which can be exploited by users with Overall/Read access to Jenkins. This might also potentially allow attackers to capture credentials stored in Jenkins, although this has not been confirmed. The form validation methods are also vulnerable to CSRF as they do not require POST requests.

Recommendations For Jenkins Amazon EC2 Plugin versions 1.47 and earlier, update to version 1.48 or later, which requires POST requests and Overall/Administer permission for the affected form validation methods, mitigating the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2090

GHSA-9HVF-PFQ3-7PP6

Affected Products

Jenkins

Jenkins Amazon Ec2 Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-2090 · Security Note
• https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1004 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2090 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9hvf-pfq3-7pp6 · Vendor Advisory
• https://github.com/jenkinsci/ec2-plugin/commit/0cdbaf2d7da5c368209f427559c8608dec22a63b · Note
• https://github.com/jenkinsci/ec2-plugin · Note