GitHub Advisoryadvisory · Maven

GHSA-hj32-9mcw-5cwh Missing permission check in Jenkins Project Inheritance Plugin

MEDIUM Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2020-2197
Ecosystem
Maven
Packages
hudson.plugins:project-inheritance
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-285
Reviewed
2022-12-21

Affected packages

• Maven hudson.plugins:project-inheritance: <= 21.04.03 (no fix yet)

Description

Jenkins limits access to job configuration XML data (`config.xml`) to users with Job/ExtendedRead permission, typically implied by Job/Configure permission. Project Inheritance Plugin has several job inspection features, including the API URL `/job/…​/getConfigAsXML` for its Inheritance Project job type that does something similar. Project Inheritance Plugin 21.04.03 and earlier does not check permissions for this new endpoint, granting access to job configuration XML data to every user with Job/Read permission. Additionally, the encrypted values of secrets stored in the job configuration are not redacted, as they would be by the `config.xml` API for users without Job/Configure permission.

Related

Alias · CVE (1)

  • CVE-2020-2197 Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance… vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References