PT-2020-15541 · Jenkins · Jenkins Aws Global Configuration Plugin+1

Published 2020-11-04 · Updated 2023-10-25 · CVE-2020-2311

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins AWS Global Configuration Plugin versions 1.5 and earlier

Description A missing permission check in the Jenkins AWS Global Configuration Plugin allows attackers with Overall/Read permission to replace the global AWS configuration. This issue is related to an HTTP endpoint that processes form submissions without properly checking permissions.

Recommendations For Jenkins AWS Global Configuration Plugin versions 1.5 and earlier, update to version 1.6 or later, which properly performs permission checks when processing configuration form submissions.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-2311

GHSA-7V7G-MH53-89HW

Affected Products

Jenkins

Jenkins Aws Global Configuration Plugin

References · 8

• https://jenkins.io/security/advisory/2020-11-04/#SECURITY-2101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2311 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2311 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7v7g-mh53-89hw · Vendor Advisory
• https://github.com/jenkinsci/aws-global-configuration-plugin/commit/783618f98dcda35cee978c54ed8760b9436f5210 · Note
• https://github.com/jenkinsci/aws-global-configuration-plugin · Note
• https://t.me/cvenotify/5143 · Telegram Post
• https://t.me/cvenotify/5098 · Telegram Post