PT-2020-15479 · Jenkins · Jenkins Blue Ocean Plugin+1

Jinchen Sheng · Published 2020-09-16 · Updated 2023-10-25 · CVE-2020-2255

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Blue Ocean Plugin versions 1.23.2 and earlier

Description A missing permission check in the Jenkins Blue Ocean Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL. The HTTP request itself is legitimate, but only authorized users should be able to perform it. This issue affects several HTTP endpoints implementing connection tests.

Recommendations For Jenkins Blue Ocean Plugin versions 1.23.2 and earlier, update to version 1.23.3 or later, which requires Item/Create permission to perform connection tests, thereby addressing the missing permission check issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-2255

GHSA-VC7G-4269-F7HW

RHSA-2020:4297

RHSA-2020:5102

Affected Products

Jenkins

Jenkins Blue Ocean Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-vc7g-4269-f7hw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2255 · Security Note
• https://jenkins.io/security/advisory/2020-09-16/#SECURITY-1961 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2255 · Vendor Advisory
• https://github.com/jenkinsci/blueocean-plugin/commit/659a66aff0d0ad693eab9d2807985d591e102aab · Note
• http://openwall.com/lists/oss-security/2020/09/16/3 · Note