CVE-2020-2242: Missing permission checks in Jenkins Database Plugin
Summary
CVE-2020-2242: Missing permission checks in Jenkins Database Plugin. Affects org.jenkins-ci.plugins:database versions < 1.7. Fixed in 1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Database Plugin is a Maven-based package that provides functionality for connecting to and interacting with databases within the Jenkins automation server. It allows users to configure database connections and execute SQL queries. This plugin is widely used in Jenkins installations for various purposes, including data storage and retrieval. However, versions 1.6 and earlier of the plugin suffer from a vulnerability that allows attackers with Overall/Read access to Jenkins to connect to a specified database server using attacker-specified credentials.
Vulnerability Detail
The vulnerability in the Jenkins Database Plugin arises from a missing permission check in versions 1.6 and earlier. Attackers with Overall/Read access to Jenkins can exploit this flaw to connect to a database server of their choice using their own credentials. This can lead to unauthorized access, data manipulation, or even a complete compromise of the database. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level. It is categorized under CWE-862 (Missing Authorization).
How To Fix
Minimum fixed version
1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Jenkins server by limiting Overall/Read permissions to trusted individuals or groups. This can be done through the Jenkins security settings. However, this workaround is not a permanent solution and should be followed by upgrading to a fixed version of the plugin.
Conclusion
The Jenkins Database Plugin versions 1.6 and earlier suffer from a vulnerability that allows attackers with Overall/Read access to Jenkins to connect to a specified database server using their own credentials. To mitigate this risk, it is crucial to upgrade to version 1.7 or later of the plugin, which introduces the necessary permission checks. Additionally, restricting access to trusted individuals or groups can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:database →
FAQ
The vulnerability allows attackers with Overall/Read access to Jenkins to connect to a specified database server using their own credentials. This can result in unauthorized access, data manipulation, or a complete compromise of the database.
Versions 1.6 and earlier of the Jenkins Database Plugin are affected by this vulnerability.
Attackers need Overall/Read access to Jenkins in order to exploit this vulnerability.
Yes, upgrading to version 1.7 or later of the Jenkins Database Plugin fixes this vulnerability.
As a temporary workaround, restricting Overall/Read access to trusted individuals or groups can help mitigate the risk. However, upgrading to a fixed version of the plugin is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:database.
