GitHub Advisoryadvisory · Maven

GHSA-6hmm-77r2-h6hr Missing permission checks in Jenkins Amazon EC2 Plugin

MEDIUM Published 2022-05-24 Modified 2022-12-21 Official page ↗
Aliases
CVE-2020-2091
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:ec2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-862
Reviewed
2022-12-21

Affected packages

• Maven org.jenkins-ci.plugins:ec2: < 1.48 → fixed in 1.48

Description

Amazon EC2 Plugin 1.47 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. This vulnerability might also allow attackers to capture credentials stored in Jenkins. We have not been able to confirm that this is possible. Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability. Amazon EC2 Plugin 1.48 requires POST requests and Overall/Administer permission for the affected form validation methods.

Related

Alias · CVE (1)

  • CVE-2020-2091 A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References