PT-2020-15509 · Jenkins · Jenkins Warnings Plugin+1

Devin Nusbaum · Published 2020-09-23 · Updated 2023-11-03 · CVE-2020-2280

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Warnings Plugin versions 5.0.1 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to execute arbitrary code. This issue arises because the plugin does not require POST requests for a form validation method intended for testing custom warnings parsers.

Recommendations For Jenkins Warnings Plugin versions 5.0.1 and earlier, update to version 5.0.2 or later, which requires POST requests for the affected form validation method, thus mitigating the CSRF vulnerability.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2280

GHSA-Q564-VVX8-9388

Affected Products

Jenkins

Jenkins Warnings Plugin

References · 6

• https://jenkins.io/security/advisory/2020-09-23/#SECURITY-2042 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2280 · Security Note
• https://osv.dev/vulnerability/GHSA-q564-vvx8-9388 · Vendor Advisory
• https://github.com/jenkinsci/warnings-plugin · Note
• http://openwall.com/lists/oss-security/2020/09/23/1 · Note