CVE-2020-2322 - Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks

Back Back to CVE browser

HIGH

Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks

Published Dec 3, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.34%

Description

Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks.

Affected products

Vendor Jenkins project Product Jenkins Chaos Monkey Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=0.3
- Version
  0.4.1
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Chaos Monkey Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=0.3
0.4.1	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-401

CWE-862

Missing Authorization

References (6)

http://www.openwall.com/lists/oss-security/2020/12/03/2
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4616
Advisory
https://github.com/advisories/GHSA-mr75-899x-qcxq
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2322
https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%281%29
x_refsource_CONFIRM
https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20(1)

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/12/03/2		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4616		Advisory
https://github.com/advisories/GHSA-mr75-899x-qcxq		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2322
https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%281%29		x_refsource_CONFIRM
https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20(1)