CVE-2020-2197 - Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format

Back Back to CVE browser

MEDIUM

Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format

Published Jun 3, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.65%

Description

Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format.

Affected products

Vendor Jenkins project Product Jenkins Project Inheritance Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=19.08.02

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Project Inheritance Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=19.08.02

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-276

Incorrect Default Permissions

CWE-285

References (5)

http://www.openwall.com/lists/oss-security/2020/06/03/3
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-hj32-9mcw-5cwh
Advisory
https://github.com/github/advisory-database/pull/1356
https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1582
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2197

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/06/03/3		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-hj32-9mcw-5cwh		Advisory
https://github.com/github/advisory-database/pull/1356
https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1582		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2197