PT-2020-15417 · Jenkins · Jenkins Fortify On Demand Plugin+1

Daniel Beck · Published 2020-07-02 · Updated 2023-10-25 · CVE-2020-2203

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Fortify on Demand Plugin versions 5.0.1 and earlier

Description A cross-site request forgery issue allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This issue requires appropriate permission in the plugin.

Recommendations For Jenkins Fortify on Demand Plugin versions 5.0.1 and earlier, consider updating to version 6.0.0 or later, which includes the necessary form validation method to prevent this issue. As a temporary workaround, restrict access to the globally configured Fortify on Demand endpoint to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2203

GHSA-P364-XFP2-F9RR

Affected Products

Jenkins

Jenkins Fortify On Demand Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-2203 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2203 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1691 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p364-xfp2-f9rr · Vendor Advisory
• https://github.com/jenkinsci/fortify-on-demand-uploader-plugin/commit/28932f7c5ff18f87d4b3a480225fb0827591776b · Note
• https://github.com/jenkinsci/fortify-on-demand-uploader-plugin · Note
• http://openwall.com/lists/oss-security/2020/07/02/7 · Note
• https://t.me/cvenotify/4810 · Telegram Post