PT-2020-15556 · Jenkins · Jenkins Chaos Monkey Plugin

Published 2020-12-03 · Updated 2023-10-25 · CVE-2020-2322

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Chaos Monkey Plugin versions 0.3 and earlier

Description The issue concerns the Jenkins Chaos Monkey Plugin, where several HTTP endpoints do not perform permission checks. This allows attackers with Overall/Read permission to generate load and to generate memory leaks.

Recommendations For Jenkins Chaos Monkey Plugin versions 0.3 and earlier, consider updating to version 0.4 or later, which requires Overall/Administer permission to generate load and to generate memory leaks, thus mitigating the risk.

Fix

Missing Authorization

Memory Leak

Weakness Enumeration

CWE-862

CWE-401

Related Identifiers

CVE-2020-2322

GHSA-MR75-899X-QCXQ

Affected Products

Jenkins Chaos Monkey Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2020-2322 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2322 · Security Note
• https://osv.dev/vulnerability/GHSA-mr75-899x-qcxq · Vendor Advisory
• https://github.com/jenkinsci/chaos-monkey-plugin · Note
• http://openwall.com/lists/oss-security/2020/12/03/2 · Note
• https://jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%281%29 · Note
• https://t.me/cibsecurity/17091 · Telegram Post
• https://jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20(1) · Note