Role-based Authorization Strategy Plugin Vulnerability in Jenkins
CVE-2020-2286

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Role-based Authorization Strategy Plugin
Vendor
CVE Published:
8 October 2020

Summary

The Role-based Authorization Strategy Plugin for Jenkins versions 3.0 and earlier suffers from a flaw that prevents proper invalidation of the permission cache when the configuration changes. This results in outdated configuration persisting and potentially granting improper permissions to users. Consequently, users may have access rights that should have been revoked, exposing the system to unauthorized access risks.

Affected Version(s)

Jenkins Role-based Authorization Strategy Plugin 2.12

Jenkins Role-based Authorization Strategy Plugin <= 3.0

References

https://www.jenkins.io/security/advisory/2020-10-08/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2020/10/08/5
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.