CVE-2020-2197 — Incorrect Default Permissions in Project Inheritance Plugin

CWE-276 — Incorrect Default PermissionsCWE-285 — Improper Authorization5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 91.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Inheritance PluginJenkins Project Inheritance
Timeline
PublishedJun 3
Latest updateMay 24

Description

Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_project_inheritance_pluginunspecified — 19.08.02

🔴Vulnerability Details

3
GHSA
Missing permission check in Jenkins Project Inheritance Plugin↗2022-05-24
▶
OSV
Missing permission check in Jenkins Project Inheritance Plugin↗2022-05-24
▶
CVEList
CVE-2020-2197: Jenkins Project Inheritance Plugin 19↗2020-06-03
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2020-06-03↗2020-06-03
▶