CVE-2020-2204: Missing permission checks in Jenkins Fortify on Demand Plugin
Summary
CVE-2020-2204: Missing permission checks in Jenkins Fortify on Demand Plugin. Affects org.jenkins-ci.plugins:fortify-on-demand-uploader versions < 6.0.1. Fixed in 6.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Fortify on Demand Plugin is a Maven package that provides integration between Jenkins and Fortify on Demand, a cloud-based application security testing platform. It allows users to upload their code to Fortify on Demand for static application security testing (SAST) and receive vulnerability reports. The plugin is widely used in software development and continuous integration pipelines.
Vulnerability Detail
The Jenkins Fortify on Demand Plugin versions 5.0.1 and earlier suffer from a missing permission check vulnerability. Attackers with Overall/Read permission can exploit this vulnerability to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This allows unauthorized access to sensitive information and potential manipulation of the Fortify on Demand environment. The vulnerability has a CVSS score of 5.4 (Medium severity).
How To Fix
Minimum fixed version
6.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the plugin to mitigate the risk.
Conclusion
The missing permission check vulnerability in Jenkins Fortify on Demand Plugin can lead to unauthorized access and potential manipulation of the Fortify on Demand environment. It is crucial to upgrade to version 6.0.0 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:fortify-on-demand-uploader →
FAQ
The vulnerability allows attackers with Overall/Read permission to connect to the Fortify on Demand endpoint using unauthorized credentials IDs. This can lead to unauthorized access to sensitive information and potential manipulation of the Fortify on Demand environment.
Users of Jenkins Fortify on Demand Plugin versions 5.0.1 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Yes, a fix is available in Jenkins Fortify on Demand Plugin version 6.0.0 or later. It is recommended to upgrade to this version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:fortify-on-demand-uploader.
