GitHub Advisoryadvisory · Maven

GHSA-vv89-xggx-qqh2 Improper permission checks in Jenkins Copy Artifact Plugin

MEDIUM Published 2022-05-24 Modified 2022-12-16 Official page ↗
Aliases
CVE-2020-2183
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:copyartifact
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-276, CWE-285
Reviewed
2022-12-16

Affected packages

• Maven org.jenkins-ci.plugins:copyartifact: < 1.44 → fixed in 1.44

Description

Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks when determining whether a build can copy artifacts from another project build. This allows attackers, usually with Job/Configure permission, to configure jobs to copy artifacts from jobs they have no permission to access. Copy Artifact Plugin 1.44 now properly performs permission checks when copying artifacts. When updating the plugin from a previous version, the previous behavior is retained (\"Migration mode\"). To enable the additional protections, switch to the new \"Production mode\". Doing so may cause existing jobs to fail to copy artifacts. For more information see the plugin documentation.

Related

Alias · CVE (1)

  • CVE-2020-2183 Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they… vulnerability

Weakness · CWE (2)

  • CWE-276 Incorrect Default Permissions weakness
  • CWE-285 Improper Authorization weakness

References