CVE-2020-2294: Missing permission checks in Jenkins Maven Cascade Release Plugin
Summary
CVE-2020-2294: Missing permission checks in Jenkins Maven Cascade Release Plugin. Affects com.barchart.jenkins:maven-release-cascade versions < 1.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Maven Cascade Release Plugin is a plugin for the Jenkins automation server that allows users to perform cascade builds and layout builds, as well as reconfigure the plugin. It is commonly used in Maven projects to automate the release process. However, versions 1.3.2 and earlier of the plugin have a vulnerability that allows attackers with Overall/Read permission to exploit several HTTP endpoints without proper permission checks.
Vulnerability Detail
The vulnerability in the Jenkins Maven Cascade Release Plugin arises from the lack of permission checks in certain HTTP endpoints. This means that attackers with Overall/Read permission can start cascade builds and layout builds, as well as reconfigure the plugin. This can lead to unauthorized access and potential misuse of the plugin's functionalities. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of the plugin to mitigate the risk of unauthorized access and misuse.
Conclusion
The Jenkins Maven Cascade Release Plugin versions 1.3.2 and earlier have a vulnerability that allows attackers with Overall/Read permission to exploit certain HTTP endpoints without proper permission checks. To mitigate this risk, it is crucial to update to version 1.3.3 or later of the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.barchart.jenkins:maven-release-cascade →
FAQ
The vulnerability allows attackers with Overall/Read permission to start cascade builds and layout builds, as well as reconfigure the plugin. This can lead to unauthorized access and potential misuse of the plugin's functionalities.
Users of Jenkins Maven Cascade Release Plugin versions 1.3.2 and earlier are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment.
Yes, a fix is available in version 1.3.3 or later of the Jenkins Maven Cascade Release Plugin.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for com.barchart.jenkins:maven-release-cascade.
