PT-2020-15324 · Jenkins · Jenkins Pipeline Github Notify Step Plugin+1

Thomas De Grenier De Latour · Published 2020-02-12 · Updated 2023-10-25 · CVE-2020-2117

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Recommendations For Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier, consider restricting access to the plugin until a patch is available, and limit the use of Overall/Read permission to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Incorrect Default Permissions

Weakness Enumeration

CWE-285

CWE-276

Related Identifiers

CVE-2020-2117

GHSA-X7RC-5MJG-5PVR

Affected Products

Jenkins

Jenkins Pipeline Github Notify Step Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-2117 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2117 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x7rc-5mjg-5pvr · Vendor Advisory
• https://github.com/jenkinsci/pipeline-githubnotify-step-plugin · Note
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-812%20(1) · Note
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-812%20%281%29 · Note
• https://t.me/cvenotify/33694 · Telegram Post