PT-2020-15405 · Jenkins · Jenkins Self-Organizing Swarm Plug-In Modules Plugin+1

Oleg Nenashev · Published 2020-06-03 · Updated 2023-10-25 · CVE-2020-2191

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Self-Organizing Swarm Plug-in Modules Plugin versions 3.20 and earlier

Description The issue concerns the lack of permission checks on API endpoints that allow adding and removing agent labels. This allows users with Agent/Create permission to modify labels of any agent. The affected API endpoints require only a global Swarm secret to use, without performing a regular permission check.

Recommendations For Jenkins Self-Organizing Swarm Plug-in Modules Plugin versions 3.20 and earlier, update to version 3.21 or later, which requires Agent/Configure permission for the affected agent to access the API endpoints and no longer uses the global Swarm secret for these endpoints.

Fix

Improper Authorization

Incorrect Default Permissions

Weakness Enumeration

CWE-285

CWE-276

Related Identifiers

CVE-2020-2191

GHSA-J852-MP82-WV2G

Affected Products

Jenkins

Jenkins Self-Organizing Swarm Plug-In Modules Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-j852-mp82-wv2g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2191 · Security Note
• https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2191 · Vendor Advisory
• https://github.com/jenkinsci/swarm-plugin/commit/4d18f98b00e4c84b152d52346fb9ef1a227b1cf7 · Note
• https://github.com/jenkinsci/swarm-plugin · Note
• https://t.me/cvenotify/4142 · Telegram Post
• http://openwall.com/lists/oss-security/2020/06/03/3 · Note