CVE-2020-2267: Missing permission checks in Jenkins MongoDB Plugin
Summary
CVE-2020-2267: Missing permission checks in MongoDB Plugin. Affects org.jenkins-ci.plugins:mongodb versions < 1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins MongoDB Plugin is a Maven package that provides integration between Jenkins and MongoDB. It allows users to store build artifacts and other data in a MongoDB database. The plugin is widely used in Jenkins installations for data storage and retrieval purposes.
Vulnerability Detail
The Jenkins MongoDB Plugin version 1.3 and earlier suffer from a missing permission check vulnerability. This vulnerability allows attackers with Overall/Read permission to access some metadata of arbitrary files on the Jenkins controller. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information stored in the MongoDB database.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of the Jenkins MongoDB Plugin to mitigate the risk.
Conclusion
The Jenkins MongoDB Plugin version 1.3 and earlier suffer from a missing permission check vulnerability that allows unauthorized access to metadata of arbitrary files. Users should upgrade to version 1.4 or later of the plugin to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mongodb →
FAQ
This vulnerability allows attackers with Overall/Read permission to access metadata of arbitrary files on the Jenkins controller. This can lead to unauthorized access to sensitive information stored in the MongoDB database.
Users of Jenkins MongoDB Plugin versions 1.3 and earlier are affected by this vulnerability.
There is no known exploit for this vulnerability at the time of this advisory.
The only mitigation for this vulnerability is to upgrade to a fixed version of the Jenkins MongoDB Plugin.
For more information about this vulnerability, refer to the GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c26h-8h4p-4jgj/GHSA-c26h-8h4p-4jgj.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mongodb.
