PT-2020-15416 · Jenkins · Jenkins Fortify On Demand Plugin+1

Daniel Beck · Published 2020-07-02 · Updated 2023-10-25 · CVE-2020-2202

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Fortify on Demand Plugin versions 6.0.0 and earlier

Description A missing permission check in form-related methods of the Jenkins Fortify on Demand Plugin allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs, which can be used as part of an attack to capture the credentials using another vulnerability.

Recommendations For Jenkins Fortify on Demand Plugin versions 6.0.0 and earlier, consider updating to version 6.0.1 or later, where an enumeration of credentials IDs now requires the appropriate permissions. As a temporary workaround, consider restricting access to the plugin's configuration to minimize the risk of exploitation.

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2020-2202

GHSA-FPH2-FWJQ-PRJF

Affected Products

Jenkins

Jenkins Fortify On Demand Plugin

References · 8

• http://openwall.com/lists/oss-security/2020/07/02/7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2202 · Security Note
• https://osv.dev/vulnerability/GHSA-fph2-fwjq-prjf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2202 · Vendor Advisory
• https://github.com/jenkinsci/fortify-on-demand-uploader-plugin/commit/28932f7c5ff18f87d4b3a480225fb0827591776b · Note
• https://github.com/jenkinsci/fortify-on-demand-uploader-plugin · Note
• https://t.me/cvenotify/4809 · Telegram Post
• https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1690 · Note