CVE-2020-2311: AWS Global Configuration Plugin - Missing Permission Check
Summary
CVE-2020-2311: Jenkins AWS Global Configuration Plugin 1.5 and earlier does not perform a permission check in an HTTP endpoint processing form submissions. Affects io.jenkins.plugins:aws-global-configuration versions < 1.6. Fixed in 1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The AWS Global Configuration Plugin is a Maven-based plugin for Jenkins that allows users to configure global AWS settings. It provides functionality for managing AWS credentials and other related configurations. The plugin is widely used in Jenkins environments to enable seamless integration with AWS services.
Vulnerability Detail
The AWS Global Configuration Plugin version 1.5 and earlier has a vulnerability that allows attackers with Overall/Read permission to replace the global AWS configuration. This vulnerability arises from a missing permission check in an HTTP endpoint that processes form submissions. By exploiting this vulnerability, an attacker can modify the global AWS configuration, potentially leading to unauthorized access, data breaches, or other security incidents. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The AWS Global Configuration Plugin version 1.5 and earlier is vulnerable to a missing permission check, allowing attackers with Overall/Read permission to modify the global AWS configuration. To mitigate this vulnerability, it is crucial to upgrade to version 1.6 or later of the plugin. No specific workaround is available, and upgrading is the recommended solution. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:aws-global-configuration →
FAQ
This vulnerability allows attackers with Overall/Read permission to modify the global AWS configuration, potentially leading to unauthorized access or data breaches.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities, including this one.
No, there is no specific workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
