PT-2020-5832 · Jenkins · Jenkins Flaky Test Handler Plugin+1

Wadeck Follonier · Published 2020-08-12 · Updated 2023-10-25 · CVE-2020-2237

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Flaky Test Handler Plugin versions 1.0.4 and earlier

Description: The issue is related to a cross-site request forgery (CSRF) vulnerability in the "Deflake this build" feature of the Jenkins Flaky Test Handler Plugin. This vulnerability can be exploited by a remote attacker to perform a cross-site request forgery, allowing them to rebuild a project at a previous git revision where the tests were failing.

Recommendations: For Jenkins Flaky Test Handler Plugin versions 1.0.4 and earlier, consider requiring POST requests for the "Deflake this build" feature to mitigate the risk of cross-site request forgery (CSRF) attacks. As a temporary workaround, restrict access to the "Deflake this build" feature until a patch is available. Avoid using the "Deflake this build" feature in the affected plugin until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2021-01801

CVE-2020-2237

GHSA-VJF8-XW6C-WJHQ

Affected Products

Jenkins

Jenkins Flaky Test Handler Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-vjf8-xw6c-wjhq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2237 · Security Note
• https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1763 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01801 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2237 · Vendor Advisory
• https://github.com/jenkinsci/flaky-test-handler-plugin · Note
• http://openwall.com/lists/oss-security/2020/08/12/4 · Note
• https://openwall.com/lists/oss-security/2020/08/12/4 · Note