GitHub Advisoryadvisory · Maven

GHSA-w6hw-57jq-h7f5 CSRF vulnerability in Amazon EC2 Plugin

LOW Published 2022-05-24 Modified 2022-12-16 Official page ↗
Aliases
CVE-2020-2186
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:ec2
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2022-12-16

Affected packages

• Maven org.jenkins-ci.plugins:ec2: < 1.50.2 → fixed in 1.50.2

Description

Amazon EC2 Plugin 1.50.1 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows an attacker to provision instances with an attacker-specified template ID. Amazon EC2 Plugin 1.50.2 now requires POST requests for the affected HTTP endpoints.

Related

Alias · CVE (1)

  • CVE-2020-2186 A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References