PT-2020-15400 · Jenkins · Jenkins Amazon Ec2 Plugin+1

Oleg Nenashev · Published 2020-05-06 · Updated 2023-10-25 · CVE-2020-2186

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier

Description A cross-site request forgery issue allows attackers to provision instances. The vulnerability is due to the plugin not requiring POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows an attacker to provision instances with an attacker-specified template ID.

Recommendations For Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier, update to version 1.50.2 or later, which requires POST requests for the affected HTTP endpoints.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2186

GHSA-W6HW-57JQ-H7F5

Affected Products

Jenkins

Jenkins Amazon Ec2 Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2186 · Security Note
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1408 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6hw-57jq-h7f5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2186 · Vendor Advisory
• https://github.com/jenkinsci/ec2-plugin · Note
• https://github.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358 · Note
• http://openwall.com/lists/oss-security/2020/05/06/3 · Note