CVE-2020-2090: CSRF vulnerability in Jenkins Amazon EC2 Plugin

org.jenkins-ci.plugins:ec2 Updated 02 Oct 2025

Summary

24/05/2022

Disclosed on

CVE-2020-2090

CVE

Yes i

Fix available

Low

Severity

3.1

CVSS Score

CVE-2020-2090: CSRF vulnerability in Jenkins Amazon EC2 Plugin. Affects org.jenkins-ci.plugins:ec2 versions < 1.48. Fixed in 1.48. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Amazon EC2 Plugin is a plugin for Jenkins, an open-source automation server. It allows users to dynamically provision EC2 instances as Jenkins agents. The plugin integrates Jenkins with Amazon Web Services (AWS) EC2, providing seamless management of EC2 instances for Jenkins jobs. This vulnerability affects versions 1.47 and earlier of the Amazon EC2 Plugin.

Vulnerability Detail

The vulnerability in the Amazon EC2 Plugin (versions 1.47 and earlier) is a Cross-Site Request Forgery (CSRF) vulnerability. It occurs due to the lack of permission checks in form validation methods. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. The vulnerability may also enable attackers to capture credentials stored in Jenkins, although this has not been confirmed. Additionally, the form validation methods do not require POST requests, making it susceptible to CSRF attacks.

How To Fix

Minimum fixed version

1.48

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

The CSRF vulnerability in the Amazon EC2 Plugin (versions 1.47 and earlier) allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs. This can potentially lead to unauthorized access and misuse of AWS resources. It is recommended to upgrade to version 1.48 of the plugin to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.jenkins-ci.plugins:ec2 →

FAQ

What is the impact of this vulnerability?

The vulnerability allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs. This can potentially lead to unauthorized access and misuse of AWS resources. It may also enable attackers to capture credentials stored in Jenkins.