PT-2020-15312 · Jenkins · Jenkins

Michele Romano · Published 2020-01-29 · Updated 2024-03-06 · CVE-2020-2105

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.218 and earlier Jenkins LTS versions 2.204.1 and earlier

Description The issue allows for clickjacking attacks due to the absence of the X-Frame-Options: deny HTTP header in REST API responses. An attacker could exploit this by tricking a user into performing an action on a specially crafted web page that embeds a REST API endpoint in an iframe, potentially allowing the attacker to learn the content of that endpoint.

Recommendations For Jenkins versions 2.218 and earlier, update to version 2.219 or later. For Jenkins LTS versions 2.204.1 and earlier, update to version 2.204.2 or later.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BIT-JENKINS-2020-2105

CVE-2020-2105

GHSA-7XP8-7WQX-5HQX

Affected Products

Jenkins

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2020-2105 · Security Note
• https://access.redhat.com/errata/RHSA-2020:0681 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2020-2105 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0683 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2105 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7xp8-7wqx-5hqx · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2020:0402 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2020:0675 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1704 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/639ade55caa05324c60d15b2fa8df27ee0111b76 · Note
• http://openwall.com/lists/oss-security/2020/01/29/1 · Note
• https://t.me/cvenotify/600 · Telegram Post