PT-2020-15299 · Cloudbees+1 · Health Advisor+1

Wadeck Follonier · Published 2020-01-15 · Updated 2023-10-25 · CVE-2020-2093

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Health Advisor by CloudBees Plugin versions 3.0 and earlier

Description A cross-site request forgery issue allows attackers to send an email with fixed content to a specified recipient. The problem arises because the plugin does not perform permission checks in methods performing form validation, allowing users with Overall/Read access to send emails. Furthermore, these form validation methods do not require POST requests, resulting in the CSRF issue.

Recommendations For Health Advisor by CloudBees Plugin versions 3.0 and earlier, update to version 3.0.1 or later, which requires POST requests and Overall/Administer permission for the affected form validation methods, thus mitigating the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2093

GHSA-FC92-8R77-9297

Affected Products

Health Advisor

Jenkins

References · 6

• https://osv.dev/vulnerability/GHSA-fc92-8r77-9297 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2093 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2093 · Vendor Advisory
• https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin · Note
• https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/f53fe8a41a1566fdd7d2996779f6c5684ef3e2df · Note