PT-2020-15454 · Jenkins · Jenkins Pipeline Maven Integration Plugin+1

Tim Jacomb · Published 2020-08-12 · Updated 2023-10-25 · CVE-2020-2233

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline Maven Integration Plugin versions 3.8.2 and earlier

Description A missing permission check in the Jenkins Pipeline Maven Integration Plugin allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue affects the plugin's HTTP endpoint, enabling attackers to obtain credentials IDs, which can be used in conjunction with another vulnerability to capture the credentials.

Recommendations For Jenkins Pipeline Maven Integration Plugin versions 3.8.2 and earlier, update to version 3.8.3 or later, which requires appropriate permissions for enumerating credentials IDs.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2020-2233

GHSA-32XP-M6VG-GWPJ

Affected Products

Jenkins

Jenkins Pipeline Maven Integration Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2020-2233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2233 · Security Note
• https://osv.dev/vulnerability/GHSA-32xp-m6vg-gwpj · Vendor Advisory
• https://github.com/jenkinsci/pipeline-maven-plugin · Note
• https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20%281%29 · Note
• https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20(1) · Note
• http://openwall.com/lists/oss-security/2020/08/12/4 · Note