Not rated

CVE-2020-2117 A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with…

Description

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Pipeline GitHub Notify Step Plugin 1.0	earliest → 1.0.4	No fix stated

The 3 CVEs of Jenkins Pipeline GitHub Notify Step Plugin →

CVE-2020-2118 A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods… Not rated CVE-2020-2116 A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows… Not rated

Do you use Jenkins Pipeline GitHub Notify Step Plugin?

Track this CVE Watch Jenkins Pipeline GitHub Notify Step Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2020-2117

Timeline

Published February 12, 2020
Last modified August 4, 2024

References

jenkins.io jenkins.io
[oss-security] 20200212 Multiple vulnerabilities in Jenkins plugins www.openwall.com

Track this CVE

CVE-2020-2117 A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with…

Description

Affected products and versions

Other CVEs of Jenkins Pipeline GitHub Notify Step Plugin