CVE-2020-2258: Incorrect permission check in Health Advisor by CloudBees Plugin
Summary
CVE-2020-2258: Incorrect permission check in Health Advisor by CloudBees Plugin. Affects org.jenkins-ci.plugins:cloudbees-jenkins-advisor versions < 3.2.1. Fixed in 3.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Health Advisor by CloudBees Plugin is a Maven package that provides health monitoring and advisory capabilities for Jenkins, an open-source automation server. It allows users to analyze the health of their Jenkins instance and provides recommendations for improvements. The plugin is widely used in Jenkins environments to ensure optimal performance and stability.
Vulnerability Detail
The Health Advisor by CloudBees Plugin version 3.2.0 and earlier contains an incorrect permission check vulnerability in one of its HTTP endpoints. This vulnerability allows attackers with Overall/Read permission to access an administrative configuration page, which should only be accessible to users with Overall/Administer permission. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive administrative settings, potentially leading to unauthorized modifications or disruptions to the Jenkins environment.
How To Fix
Latest published version: 412.v9d1e9d6a_f428 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the Health Advisor by CloudBees Plugin to address the issue effectively.
Conclusion
The Health Advisor by CloudBees Plugin version 3.2.0 and earlier contains a vulnerability that allows attackers with Overall/Read permission to access an administrative configuration page. To mitigate the risk of unauthorized access and potential disruptions to the Jenkins environment, users should upgrade to version 3.2.1 or later of the plugin. If upgrading is not feasible, access to the affected administrative configuration page should be restricted to users with Overall/Administer permission. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cloudbees-jenkins-advisor →
FAQ
This vulnerability allows attackers with Overall/Read permission to access an administrative configuration page, potentially leading to unauthorized modifications or disruptions to the Jenkins environment.
Users of Health Advisor by CloudBees Plugin versions 3.2.0 and earlier are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this report.
Yes, this vulnerability has been fixed in Health Advisor by CloudBees Plugin version 3.2.1.
If upgrading to the fixed version is not possible, it is recommended to restrict access to the affected administrative configuration page by adjusting the permissions of the affected users.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cloudbees-jenkins-advisor.
