PT-2020-15410 · Jenkins · Jenkins Selenium Plugin+1

Daniel Beck + 1 · Published 2020-06-03 · Updated 2023-10-25 · CVE-2020-2196

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Selenium Plugin versions 3.141.59 and earlier

Description The issue concerns a lack of CSRF protection for HTTP endpoints in the Jenkins Selenium Plugin, allowing attackers to perform administrative actions. Specifically, this enables attackers to restart the Selenium Grid hub, delete or replace the plugin configuration, and start, stop, or restart Selenium configurations on specific nodes. Through carefully chosen configuration parameters, these actions can result in OS command injection on the Jenkins controller.

Recommendations For Jenkins Selenium Plugin versions 3.141.59 and earlier, consider disabling access to the plugin's HTTP endpoints until a fix is available to prevent potential exploitation. Restricting configuration changes and node management can also help minimize the risk. As a temporary workaround, limit the ability to restart the Selenium Grid hub and modify plugin configurations to authorized personnel only.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2196

GHSA-RP4X-XPGF-4XV7

Affected Products

Jenkins

Jenkins Selenium Plugin

References · 7

• https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2196 · Security Note
• https://osv.dev/vulnerability/GHSA-rp4x-xpgf-4xv7 · Vendor Advisory
• https://github.com/jenkinsci/selenium-plugin · Note
• http://openwall.com/lists/oss-security/2022/04/14/2 · Note
• http://openwall.com/lists/oss-security/2020/06/03/3 · Note