PT-2020-15483 · Cloudbees+1 · Jenkins Health Advisor By Cloudbees Plugin+1

Matt Sicker · Published 2020-09-16 · Updated 2023-10-25 · CVE-2020-2258

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Health Advisor by CloudBees Plugin versions 3.2.0 and earlier

Description The issue arises from an incorrect permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view the endpoint, which includes an administrative configuration page.

Recommendations For Jenkins Health Advisor by CloudBees Plugin versions 3.2.0 and earlier, update to version 3.2.1 or later, which requires Overall/Administer permission to view the administrative configuration page, thus mitigating the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-2258

GHSA-C445-XM3F-HMFH

Affected Products

Jenkins

Jenkins Health Advisor By Cloudbees Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-c445-xm3f-hmfh · Vendor Advisory
• https://jenkins.io/security/advisory/2020-09-16/#SECURITY-1998 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2258 · Security Note
• https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin · Note
• https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/90f693a4b9fc60292463ecd7aa06c2c53d9dea30 · Note
• http://openwall.com/lists/oss-security/2020/09/16/3 · Note