GitHub Advisoryadvisory · Maven

GHSA-mr75-899x-qcxq Missing permission checks in Jenkins Chaos Monkey Plugin

HIGH Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2020-2322
Ecosystem
Maven
Packages
io.jenkins.plugins:chaos-monkey
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-401, CWE-862
Reviewed
2022-12-16

Affected packages

• Maven io.jenkins.plugins:chaos-monkey: < 0.4 → fixed in 0.4

Description

Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to generate load and to generate memory leaks. Jenkins Chaos Monkey Plugin 0.4 requires Overall/Administer permission to generate load and to generate memory leaks.

Related

Alias · CVE (1)

  • CVE-2020-2322 Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with… vulnerability

Weakness · CWE (2)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness
  • CWE-862 Missing Authorization weakness

References