PT-2020-15538 · Jenkins · Jenkins Kubernetes Plugin+1

Published 2020-11-04 · Updated 2023-10-25 · CVE-2020-2308

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Kubernetes Plugin versions 1.27.3 and earlier Jenkins Kubernetes Plugin versions prior to 1.27.4 Jenkins Kubernetes Plugin versions prior to 1.26.5 Jenkins Kubernetes Plugin versions prior to 1.25.4.1 Jenkins Kubernetes Plugin versions prior to 1.21.6

Description A missing permission check in the Jenkins Kubernetes Plugin allows attackers with Overall/Read permission to list global pod template names. This issue is related to an HTTP endpoint that does not perform a permission check, enabling attackers to exploit this weakness.

Recommendations For Jenkins Kubernetes Plugin version 1.27.3 and earlier, update to version 1.27.4 or later. For Jenkins Kubernetes Plugin versions prior to 1.26.5, update to version 1.26.5 or later. For Jenkins Kubernetes Plugin versions prior to 1.25.4.1, update to version 1.25.4.1 or later. For Jenkins Kubernetes Plugin versions prior to 1.21.6, update to version 1.21.6 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-2308

GHSA-RR6J-37CV-C7X7

RHSA-2021:0034

RHSA-2021:0038

RHSA-2021:0637

Affected Products

Jenkins

Jenkins Kubernetes Plugin

References · 5

• https://jenkins.io/security/advisory/2020-11-04/#SECURITY-2102 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rr6j-37cv-c7x7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2308 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2308 · Vendor Advisory
• https://github.com/jenkinsci/kubernetes-plugin/commit/7aac20940e637cdd2e38d3afd3748704e4015782 · Note