CVE-2020-2241: CSRF vulnerability in Jenkins Database Plugin
Summary
CVE-2020-2241: CSRF vulnerability in Jenkins Database Plugin. Affects org.jenkins-ci.plugins:database versions < 1.7. Fixed in 1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Database Plugin is a Maven-based package that provides functionality for connecting to and interacting with databases within Jenkins. It allows users to configure database connections and perform various database operations. The plugin is widely used in Jenkins installations for managing database-related tasks.
Vulnerability Detail
A cross-site request forgery (CSRF) vulnerability has been identified in Jenkins Database Plugin versions 1.6 and earlier. This vulnerability enables attackers to execute unauthorized actions on behalf of authenticated users. Specifically, an attacker can connect to a database server of their choice using attacker-specified credentials. The vulnerability arises from a lack of proper form validation in the affected versions of the plugin. The impact of this vulnerability can range from unauthorized access to sensitive data to potential manipulation of the database.
How To Fix
Latest published version: 343.v7fdd4652e742 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The CSRF vulnerability in Jenkins Database Plugin versions 1.6 and earlier poses a moderate risk to Jenkins installations. It is crucial to upgrade to version 1.7 or later of the plugin to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:database →
FAQ
The vulnerability allows attackers to connect to an attacker-specified database server using attacker-specified credentials. This can lead to unauthorized access to sensitive data and potential manipulation of the database.
Versions 1.6 and earlier of the Jenkins Database Plugin are affected by this vulnerability.
No specific workaround is mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.4.
For more information, you can refer to the GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9rvw-7mx7-h53x/GHSA-9rvw-7mx7-h53x.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:database.
