CVE-2020-2142: Missing permission checks in Jenkins P4 Plugin
Summary
CVE-2020-2142: Missing permission checks in Jenkins P4 Plugin. Affects org.jenkins-ci.plugins:p4 versions < 1.10.11. Fixed in 1.10.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins P4 Plugin is a Maven-based open-source plugin that integrates Jenkins with the Perforce version control system. It provides functionality for managing Perforce repositories, triggering builds, and adding labels. The plugin allows users to configure Jenkins jobs to interact with Perforce repositories, enabling seamless integration between the two systems.
Vulnerability Detail
The Jenkins P4 Plugin version 1.10.10 and earlier suffer from a missing permission check vulnerability. Attackers with Overall/Read permission can exploit this vulnerability to trigger builds or add labels in the Perforce repository. This can lead to unauthorized access, potential code execution, and other malicious activities. The vulnerability has been assigned the CVE identifier CVE-2020-2142 and has a CVSS score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
How To Fix
Latest published version: 1.18.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by upgrading to the latest version of the Jenkins P4 Plugin.
Conclusion
The Jenkins P4 Plugin version 1.10.10 and earlier suffer from a missing permission check vulnerability, allowing attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository. To mitigate this vulnerability, it is recommended to upgrade to Jenkins P4 Plugin version 1.10.11 or later. This will ensure appropriate permission checks are in place. For further support on vulnerability remediation or any other security concerns, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:p4 →
FAQ
The vulnerability allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository. This can lead to unauthorized access, potential code execution, and other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins P4 Plugin version is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
There are no known exploits available for this vulnerability at the time of writing. However, it is crucial to apply the fix promptly to mitigate the risk of potential exploitation.
No, the recommended mitigation is to upgrade to the latest version of the Jenkins P4 Plugin. This ensures that appropriate permission checks are in place to prevent unauthorized access and malicious activities.
For further support on vulnerability remediation or any other security concerns, you can contact info@devnack.com. Our team of experts will be happy to assist you.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:p4.
