PT-2020-15456 · Jenkins · Jenkins Pipeline Maven Integration Plugin+1

Tim Jacomb · Published 2020-08-12 · Updated 2023-10-25 · CVE-2020-2235

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline Maven Integration Plugin versions 3.8.2 and earlier

Description A cross-site request forgery (CSRF) vulnerability exists, allowing attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs, potentially capturing credentials stored in Jenkins. This issue arises due to a lack of permission checks in a form validation method, which can be exploited by users with Overall/Read access to Jenkins. The form validation method is also vulnerable to CSRF attacks because it does not require POST requests.

Recommendations For Jenkins Pipeline Maven Integration Plugin versions 3.8.2 and earlier, update to version 3.8.3 or later, which requires POST requests and Job/Configure permission for the affected form validation method, mitigating the CSRF vulnerability.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2235

GHSA-C2HG-2JJ6-H8VH

Affected Products

Jenkins

Jenkins Pipeline Maven Integration Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2235 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2235 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2hg-2jj6-h8vh · Vendor Advisory
• https://github.com/jenkinsci/pipeline-maven-plugin · Note
• https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20%282%29 · Note
• https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20(2) · Note
• http://openwall.com/lists/oss-security/2020/08/12/4 · Note