CVE-2020-2197
published 2020-06-03CVE-2020-2197: Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job…
PriorityP419medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.65%
46.9th percentile
Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | compact_columns_plugin | — | — |
| jenkins | echarts_api_plugin | — | — |
| jenkins | play_framework_plugin | — | — |
| jenkins | project_inheritance | <= 19.08.02 | — |
| jenkins | project_inheritance_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | selenium_plugin | — | — |
| jenkins | subversion_partial_release_manager_plugin | — | — |
| jenkins | swarm_plugin | — | — |
| jenkins_project | jenkins_project_inheritance_plugin | unspecified – 19.08.02 | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing permission check in Jenkins Project Inheritance Plugin
ghsa·2022-05-24
CVE-2020-2197 [MEDIUM] CWE-285 Missing permission check in Jenkins Project Inheritance Plugin
Missing permission check in Jenkins Project Inheritance Plugin
Jenkins limits access to job configuration XML data (`config.xml`) to users with Job/ExtendedRead permission, typically implied by Job/Configure permission. Project Inheritance Plugin has several job inspection features, including the API URL `/job/…/getConfigAsXML` for its Inheritance Project job type that does something similar.
Project Inheritance Plugin 21.04.03 and earlier does not check permissions for this new endpoint, granting access to job configuration XML data to every user with Job/Read permission.
Additionally, the encrypted values of secrets stored in the job configuration are not redacted, as they would be by the `config.xml` API for users without Job/Configure permission.
OSV
Missing permission check in Jenkins Project Inheritance Plugin
osv·2022-05-24
CVE-2020-2197 [MEDIUM] Missing permission check in Jenkins Project Inheritance Plugin
Missing permission check in Jenkins Project Inheritance Plugin
Jenkins limits access to job configuration XML data (`config.xml`) to users with Job/ExtendedRead permission, typically implied by Job/Configure permission. Project Inheritance Plugin has several job inspection features, including the API URL `/job/…/getConfigAsXML` for its Inheritance Project job type that does something similar.
Project Inheritance Plugin 21.04.03 and earlier does not check permissions for this new endpoint, granting access to job configuration XML data to every user with Job/Read permission.
Additionally, the encrypted values of secrets stored in the job configuration are not redacted, as they would be by the `config.xml` API for users without Job/Configure permission.
Jenkins
Jenkins Security Advisory 2020-06-03
vendor_jenkins·2020-06-03·CVSS 5.4
CVE-2020-2190 [MEDIUM] Jenkins Security Advisory 2020-06-03
Title: Jenkins Security Advisory 2020-06-03
Jenkins Security Advisory 2020-06-03
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Compact Columns
Plugin
ECharts API
Plugin
Play Framework
Plugin
Project Inheritance
Plugin
Script Security
Plugin
Selenium
Plugin
Subversion Partial Release Manager
P
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-06-03
Published