PT-2020-15406 · Jenkins · Jenkins Self-Organizing Swarm Plug-In Modules Plugin+1

Oleg Nenashev · Published 2020-06-03 · Updated 2023-10-25 · CVE-2020-2192

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Self-Organizing Swarm Plug-in Modules Plugin versions 3.20 and earlier

Description A cross-site request forgery issue allows attackers to add or remove agent labels. The Swarm Plugin adds API endpoints to manage agent labels, but in versions 3.20 and earlier, these endpoints only require a global Swarm secret and do not perform regular permission checks. This allows users with Agent/Create permission to modify labels of any agent. Furthermore, these API endpoints can be exploited without requiring POST requests, leading to a cross-site request forgery vulnerability.

Recommendations For Jenkins Self-Organizing Swarm Plug-in Modules Plugin versions 3.20 and earlier, update to version 3.21 or later, which requires POST requests and Agent/Configure permission for the affected agent to access the API endpoints, and no longer uses the global Swarm secret for these operations.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2192

GHSA-C264-8834-PPJ2

Affected Products

Jenkins

Jenkins Self-Organizing Swarm Plug-In Modules Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2020-2192 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c264-8834-ppj2 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2192 · Security Note
• https://github.com/jenkinsci/swarm-plugin/commit/4d18f98b00e4c84b152d52346fb9ef1a227b1cf7 · Note
• https://github.com/jenkinsci/swarm-plugin · Note
• https://t.me/cvenotify/4143 · Telegram Post
• http://openwall.com/lists/oss-security/2020/06/03/3 · Note