PT-2020-15493 · Jenkins · Jenkins Mongodb Plugin+1

Wadeck Follonier · Published 2020-09-16 · Updated 2024-01-09 · CVE-2020-2268

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins MongoDB Plugin versions 1.3 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller. This issue arises because the plugin does not perform permission checks in methods implementing form validation, enabling attackers with Overall/Read permission to exploit this vulnerability. Furthermore, the form validation methods do not require POST requests, contributing to the CSRF vulnerability.

Recommendations For Jenkins MongoDB Plugin versions 1.3 and earlier, as a temporary workaround, consider restricting access to the form validation methods to minimize the risk of exploitation. Additionally, restrict Overall/Read permission to trusted users only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2268

GHSA-J6P9-HM3Q-HWMJ

Affected Products

Jenkins

Jenkins Mongodb Plugin

References · 7

• https://jenkins.io/security/advisory/2020-09-16/#SECURITY-1904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2268 · Security Note
• https://osv.dev/vulnerability/GHSA-j6p9-hm3q-hwmj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2268 · Vendor Advisory
• https://github.com/jenkinsci/mongodb-plugin · Note
• https://t.me/cvenotify/66713 · Telegram Post
• http://openwall.com/lists/oss-security/2020/09/16/3 · Note