PT-2020-15396 · Jenkins · Jenkins Artifactory Plugin+1

Jesse Glick · Published 2020-05-06 · Updated 2023-10-25 · CVE-2020-2183

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Copy Artifact Plugin versions 1.43.1 and earlier

Description The issue arises from improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access. This is particularly concerning for attackers with Job/Configure permission, as they can configure jobs to copy artifacts from restricted jobs. The estimated number of potentially affected devices worldwide is not available.

Recommendations For Jenkins Copy Artifact Plugin versions 1.43.1 and earlier, update to version 1.44 or later. After updating, switch from "Migration mode" to "Production mode" to enable the additional protections, noting that this may cause existing jobs to fail to copy artifacts.

Fix

Improper Authorization

Incorrect Default Permissions

Weakness Enumeration

CWE-285

CWE-276

Related Identifiers

CVE-2020-2183

GHSA-VV89-XGGX-QQH2

Affected Products

Jenkins

Jenkins Artifactory Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2183 · Security Note
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-988 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vv89-xggx-qqh2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2183 · Vendor Advisory
• https://github.com/jenkinsci/copyartifact-plugin · Note
• https://github.com/jenkinsci/copyartifact-plugin/commit/dc87de169604cb9b6706c5328e2e4aeb2c6652d6 · Note
• http://openwall.com/lists/oss-security/2020/05/06/3 · Note