PT-2020-15297 · Jenkins · Jenkins Amazon Ec2 Plugin+1

Oleg Nenashev · Published 2020-01-15 · Updated 2023-10-25 · CVE-2020-2091

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Amazon EC2 Plugin versions 1.47 and earlier

Description A missing permission check in the Jenkins Amazon EC2 Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. This issue may also potentially allow attackers to capture credentials stored in Jenkins, although this has not been confirmed. Additionally, the form validation methods are vulnerable to CSRF attacks because they do not require POST requests.

Recommendations For Jenkins Amazon EC2 Plugin versions 1.47 and earlier, update to version 1.48 or later, which requires POST requests and Overall/Administer permission for the affected form validation methods, thus mitigating the issue. As a temporary workaround, consider restricting access to the plugin's form validation methods to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-2091

GHSA-6HMM-77R2-H6HR

Affected Products

Jenkins

Jenkins Amazon Ec2 Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2091 · Security Note
• https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1004 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2091 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6hmm-77r2-h6hr · Vendor Advisory
• https://github.com/jenkinsci/ec2-plugin/commit/0cdbaf2d7da5c368209f427559c8608dec22a63b · Note
• https://github.com/jenkinsci/ec2-plugin · Note
• https://t.me/cvenotify/33695 · Telegram Post