CVE-2020-2183: Improper permission checks in Jenkins Copy Artifact Plugin
Summary
CVE-2020-2183: Improper permission checks in Jenkins Copy Artifact Plugin. Affects org.jenkins-ci.plugins:copyartifact versions < 1.44. Fixed in 1.44. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Copy Artifact Plugin is a Maven package that allows users to copy artifacts from one Jenkins project build to another. It provides a convenient way to share files and resources between different builds. The plugin is widely used in Jenkins-based CI/CD pipelines to streamline the build and deployment process.
Vulnerability Detail
Copy Artifact Plugin versions 1.43.1 and earlier suffer from a vulnerability that allows attackers with Job/Configure permission to configure jobs to copy artifacts from other jobs they do not have permission to access. This improper permission check can lead to unauthorized access to sensitive artifacts and resources. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.44
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the Copy Artifact Plugin to the latest version as described in the 'how_to_fix' section.
Conclusion
The Jenkins Copy Artifact Plugin versions 1.43.1 and earlier are vulnerable to improper permission checks, allowing unauthorized access to artifacts. To mitigate this vulnerability, it is crucial to update the plugin to version 1.44 or later and switch to Production mode. This will ensure proper permission checks when copying artifacts and prevent unauthorized access. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:copyartifact →
FAQ
This vulnerability allows attackers with Job/Configure permission to configure jobs to copy artifacts from other jobs they do not have permission to access. It can lead to unauthorized access to sensitive artifacts and resources.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Copy Artifact Plugin versions 1.43.1 and earlier are affected by this vulnerability.
To fix this vulnerability, update the Copy Artifact Plugin to version 1.44 or later and switch to Production mode as described in the 'how_to_fix' section.
There are no specific workarounds mentioned for this vulnerability. Updating the plugin to the latest version is the recommended approach.
