CVE-2020-2197 – hudson.plugins:project-inheritance

Package

Manager: maven
Name: hudson.plugins:project-inheritance
Vulnerable Version: >=0 <=21.04.03

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00031 pctl0.07238

Details

Missing permission check in Jenkins Project Inheritance Plugin Jenkins limits access to job configuration XML data (`config.xml`) to users with Job/ExtendedRead permission, typically implied by Job/Configure permission. Project Inheritance Plugin has several job inspection features, including the API URL `/job/…​/getConfigAsXML` for its Inheritance Project job type that does something similar. Project Inheritance Plugin 21.04.03 and earlier does not check permissions for this new endpoint, granting access to job configuration XML data to every user with Job/Read permission. Additionally, the encrypted values of secrets stored in the job configuration are not redacted, as they would be by the `config.xml` API for users without Job/Configure permission.

Metadata

Created: 2022-05-24T17:19:05Z
Modified: 2023-10-26T22:24:33Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hj32-9mcw-5cwh/GHSA-hj32-9mcw-5cwh.json
CWE IDs: ["CWE-285"]
Alternative ID: GHSA-hj32-9mcw-5cwh
Finding: F039
Auto approve: 1