PT-2020-15461 · Jenkins · Jenkins Database Plugin+1

Oleg Nenashev · Published 2020-09-01 · Updated 2023-10-25 · CVE-2020-2240

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Database Plugin versions 1.6 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to execute arbitrary SQL scripts because the database console does not require POST requests. This issue enables attackers to perform unauthorized actions.

Recommendations For Jenkins Database Plugin versions 1.6 and earlier, update to version 1.7 or later, which removes the vulnerable database console.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2240

GHSA-JF9J-HX2J-M9XH

Affected Products

Jenkins

Jenkins Database Plugin

References · 7

• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1023 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2240 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jf9j-hx2j-m9xh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2240 · Security Note
• https://github.com/jenkinsci/database-plugin · Note
• https://github.com/jenkinsci/database-plugin/commit/a68258cf17ba8d5264010cc760770a62a3cc6c2d · Note
• http://openwall.com/lists/oss-security/2020/09/01/3 · Note