CVE-2020-2255 — jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP endpoints implementing connection tests.

Back Back to CVE browser

MEDIUM

jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP endpoints implementing connection tests.

Published Sep 16, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.85%

Description

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Affected products

Vendor Jenkins project Product Jenkins Blue Ocean Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.23.2
- Version
  1.19.2
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Blue Ocean Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=1.23.2
1.19.2	unaffected	-

Red Hat OpenShift Container Platform 3.11

jenkins-2-plugins-0:3.11.1603460090-1.el7

Fixed · RHSA-2020:5102
Red Hat OpenShift Container Platform 4.6

jenkins-2-plugins-0:4.6.1601368321-1.el8

Fixed · RHSA-2020:4297

Product	Package	State	Advisory
Red Hat OpenShift Container Platform 3.11	jenkins-2-plugins-0:3.11.1603460090-1.el7	Fixed	RHSA-2020:5102
Red Hat OpenShift Container Platform 4.6	jenkins-2-plugins-0:4.6.1601368321-1.el8	Fixed	RHSA-2020:4297

Remediation

No remediation recorded yet.

Metrics

0.85% 0.00849

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00849

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.85% (0.00849)	56.59th	v5 (v2026.06.15)
Sep 20, 2026	0.85% (0.00849)	56.56th	v5 (v2026.06.15)
Jul 20, 2024	0.05% (0.00054)	22.53th	v3 (v2023.03.01)
Jun 15, 2024	0.05% (0.00054)	22.05th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00054)	20.04th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	4.50% (0.04499)	74.08th	v2 (v2022.01.01)
Feb 3, 2022	2.74% (0.02742)	63.06th	v1
Jan 6, 2022	2.74% (0.02742)	62.72th	v1
Jan 5, 2022	0.62% (0.00624)	46.35th	v5 (v2026.06.15)
Apr 14, 2021	0.62% (0.00624)	0.00th	v1

Weaknesses (1)

CWE-862

Missing Authorization

References (9)

http://www.openwall.com/lists/oss-security/2020/09/16/3
mailing-listx_refsource_MLISTThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-2255
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1880460
Issue Tracking
https://github.com/advisories/GHSA-vc7g-4269-f7hw
Advisory
https://github.com/jenkinsci/blueocean-plugin/commit/659a66aff0d0ad693eab9d2807985d591e102aab
https://nvd.nist.gov/vuln/detail/CVE-2020-2255
https://www.cve.org/CVERecord?id=CVE-2020-2255
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1961
x_refsource_CONFIRMVendor Advisory
https://www.openwall.com/lists/oss-security/2020/09/16/3

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/09/16/3		mailing-listx_refsource_MLISTThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-2255		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1880460		Issue Tracking
https://github.com/advisories/GHSA-vc7g-4269-f7hw		Advisory
https://github.com/jenkinsci/blueocean-plugin/commit/659a66aff0d0ad693eab9d2807985d591e102aab
https://nvd.nist.gov/vuln/detail/CVE-2020-2255
https://www.cve.org/CVERecord?id=CVE-2020-2255
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1961		x_refsource_CONFIRMVendor Advisory
https://www.openwall.com/lists/oss-security/2020/09/16/3