PT-2020-15510 · Jenkins · Jenkins Lockable Resources Plugin+1

Pierre Beitz · Published 2020-09-23 · Updated 2023-12-21 · CVE-2020-2281

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Lockable Resources Plugin versions 2.8 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to reserve, unreserve, unlock, and reset resources. This issue arises because the plugin does not require POST requests for several HTTP endpoints, making it vulnerable to CSRF attacks. The vulnerability enables attackers to perform unauthorized actions on resources.

Recommendations For Jenkins Lockable Resources Plugin versions 2.8 and earlier, update to version 2.9 or later, which requires POST requests for the affected HTTP endpoints, thereby mitigating the CSRF vulnerability.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-2281

GHSA-RVWW-W62M-HCH8

Affected Products

Jenkins

Jenkins Lockable Resources Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-2281 · Security Note
• https://osv.dev/vulnerability/GHSA-rvww-w62m-hch8 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-09-23/#SECURITY-1958 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2281 · Vendor Advisory
• https://github.com/jenkinsci/lockable-resources-plugin · Note
• https://github.com/jenkinsci/lockable-resources-plugin/commit/50ab82498f792775a761e6f4937607b240ecde67 · Note
• https://t.me/cvenotify/64568 · Telegram Post
• http://openwall.com/lists/oss-security/2020/09/23/1 · Note