CVE-2020-2282: Missing permission check in Jenkins Implied Labels Plugin allows reconfiguring the plugin
Summary
CVE-2020-2282: Missing permission check in Jenkins Implied Labels Plugin allows reconfiguring the plugin. Affects org.jenkins-ci.plugins:implied-labels versions < 0.7. Fixed in 0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Implied Labels Plugin is a Maven-based open-source plugin that provides functionality for configuring implied labels in Jenkins. Implied labels are used to automatically assign labels to Jenkins agents based on the labels of the jobs they are running. This plugin allows users to define rules for assigning labels to agents, improving the efficiency of job distribution in Jenkins.
Vulnerability Detail
The Implied Labels Plugin version 0.6 and earlier contains a vulnerability that allows attackers with Overall/Read permission to reconfigure the plugin without proper permission checks. This means that an attacker with the required permission can modify the plugin's configuration, potentially leading to unauthorized access or disruption of the Jenkins environment. The vulnerability has been assigned a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, administrators can mitigate the risk by ensuring that only trusted users have Overall/Read permission in Jenkins. Additionally, monitoring and auditing the plugin's configuration changes can help detect any unauthorized modifications.
Conclusion
The Implied Labels Plugin vulnerability (CVE-2020-2282) allows attackers with Overall/Read permission to reconfigure the plugin, potentially leading to unauthorized access or disruption of the Jenkins environment. To mitigate this vulnerability, it is recommended to upgrade to Implied Labels Plugin version 0.7 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:implied-labels →
FAQ
The vulnerability allows attackers with Overall/Read permission to modify the configuration of the Implied Labels Plugin, potentially leading to unauthorized access or disruption of the Jenkins environment.
Users of Implied Labels Plugin versions 0.6 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, upgrading to Implied Labels Plugin version 0.7 or later fixes this vulnerability.
Attackers with Overall/Read permission in Jenkins can exploit this vulnerability.
