Man-in-the-Middle Vulnerability in Jenkins Amazon EC2 Plugin by CloudBees
CVE-2020-2187

5.6MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Amazon Ec2 Plugin
Vendor
CVE Published:
6 May 2020

Summary

The Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier are vulnerable due to the unconditioned acceptance of self-signed certificates and the absence of hostname validation. This vulnerability could allow attackers to execute man-in-the-middle (MITM) attacks, intercepting and manipulating data transmitted between the Jenkins server and the EC2 instances. It is crucial for users to ensure that only trusted certificates are used and that proper hostname validation is implemented to safeguard against unauthorized access and ensure secure communication.

Affected Version(s)

Jenkins Amazon EC2 Plugin <= 1.50.1

References

https://jenkins.io/security/advisory/2020-05-06/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2020/05/06/3
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.