PT-2020-15517 · Jenkins · Stapler+2

Daniel Beck + 1 · Published 2020-10-08 · Updated 2023-10-25 · CVE-2020-2287

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Audit Trail Plugin versions 3.6 and earlier

Description The issue arises from a discrepancy in how the Audit Trail Plugin and the Stapler web framework parse URL paths, allowing attackers to craft URLs that bypass request logging. This affects Jenkins versions 2.227 and earlier, as well as LTS 2.204.5 and earlier, due to the difference in URL path representation used by the plugin and the Stapler framework.

Recommendations For Jenkins Audit Trail Plugin versions 3.6 and earlier, update to version 3.7 or later to resolve the issue, as it processes request URL paths the same way as the Stapler web framework.

Fix

Weakness Enumeration

CWE-435

Related Identifiers

CVE-2020-2287

GHSA-RPJ6-2Q8R-98F8

Affected Products

Jenkins

Jenkins Audit Trail Plugin

Stapler

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2287 · Security Note
• https://jenkins.io/security/advisory/2020-10-08/#SECURITY-1815 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rpj6-2q8r-98f8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2287 · Vendor Advisory
• https://github.com/jenkinsci/audit-trail-plugin · Note
• https://github.com/jenkinsci/audit-trail-plugin/commit/329c6090c1c444a16e95757e537b0cbb2347a9f4 · Note
• http://openwall.com/lists/oss-security/2020/10/08/5 · Note