CVE-2020-2142 — Missing Authorization in Project Jenkins P4 Plugin

CWE-862 — Missing AuthorizationCWE-319 — Cleartext Transmission of Sensitive Info6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 91.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins P4 PluginJenkins P4
Timeline
PublishedMar 9
Latest updateMay 24

Description

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_p4_pluginunspecified — 1.10.10
▶NVDjenkins/p41.10.10

🔴Vulnerability Details

3
GHSA
Missing permission checks in Jenkins P4 Plugin↗2022-05-24
▶
OSV
Missing permission checks in Jenkins P4 Plugin↗2022-05-24
▶
CVEList
CVE-2020-2142: A missing permission check in Jenkins P4 Plugin 1↗2020-03-09
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2020-03-09↗2020-03-09
▶

💬Community

1
Bugzilla
CVE-2020-10997 percona-xtrabackup: Information exposure via cmd line output and table history↗2020-04-27
▶
CVE-2020-2142 — Missing Authorization | cvebase