CVE-2020-2234: Jenkins Pipeline Maven Integration Plugin - Missing Permission Check
Summary
CVE-2020-2234: Missing permission check in Jenkins Pipeline Maven Integration Plugin allow capturing credentials. Affects org.jenkins-ci.plugins:pipeline-maven versions < 3.8.3. Fixed in 3.8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline Maven Integration Plugin is a plugin for the Jenkins automation server that allows users to integrate Maven projects into Jenkins pipelines. It provides functionality for managing Maven dependencies, running Maven goals, and publishing Maven artifacts. This plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Pipeline Maven Integration Plugin version 3.8.2 and earlier contains a vulnerability that allows users with Overall/Read access to Jenkins to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method. This can potentially lead to the capture of credentials stored in Jenkins. Additionally, the form validation method used in the plugin does not require POST requests, making it vulnerable to cross-site request forgery (CSRF) attacks. The vulnerability has been assigned a CVSS score of 7.1, indicating a high severity level.
How To Fix
Minimum fixed version
3.8.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to upgrade to the latest version of the plugin as soon as possible.
Conclusion
The Jenkins Pipeline Maven Integration Plugin version 3.8.2 and earlier is vulnerable to a missing permission check and CSRF vulnerability. Upgrading to version 3.8.3 or later is crucial to address these security issues. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-maven →
FAQ
This vulnerability allows users with Overall/Read access to Jenkins to potentially capture credentials stored in Jenkins, posing a significant security risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, upgrading to version 3.8.3 or later of the Pipeline Maven Integration Plugin fixes this vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the recommended fix to prevent any potential exploitation.
No, upgrading to the latest version of the plugin is the recommended solution to mitigate this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-maven.
