PT-2020-15325 · Jenkins · Jenkins Pipeline Github Notify Step Plugin+1
Thomas De Grenier De Latour
·
Published
2020-02-12
·
Updated
2023-10-25
·
CVE-2020-2118
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier
Description
A missing permission check in form-related methods of the Jenkins Pipeline GitHub Notify Step Plugin allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This functionality provides a list of applicable credential IDs to users configuring the plugin, but it does not correctly check permissions. As a result, any user with Overall/Read permission can obtain a list of valid credentials IDs, which can be used as part of an attack to capture the credentials using another vulnerability.
Recommendations
For Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier, update to version 1.0.5 or later, which requires the permission to configure a project for an enumeration of credentials IDs. As a temporary workaround, consider restricting access to the plugin's configuration to minimize the risk of exploitation.
Fix
Improper Authorization
Incorrect Default Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Jenkins
Jenkins Pipeline Github Notify Step Plugin