PT-2020-15462 · Jenkins · Jenkins Database Plugin+1

Oleg Nenashev · Published 2020-09-01 · Updated 2023-12-21 · CVE-2020-2241

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins database Plugin versions 1.6 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified database server using attacker-specified credentials. The vulnerability affects the form validation method, which in version 1.7 and later requires POST requests.

Recommendations For Jenkins database Plugin versions 1.6 and earlier, update to version 1.7 or later, which requires POST requests for the affected form validation method, mitigating the CSRF risk.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2241

GHSA-9RVW-7MX7-H53X

Affected Products

Jenkins

Jenkins Database Plugin

References · 8

• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1024 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9rvw-7mx7-h53x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2241 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2241 · Vendor Advisory
• https://github.com/jenkinsci/database-plugin · Note
• https://github.com/jenkinsci/database-plugin/commit/7a438d96897af0034cb2e06db0819ca4595c24cb · Note
• http://openwall.com/lists/oss-security/2020/09/01/3 · Note
• https://t.me/cvenotify/64567 · Telegram Post