Missing permission check in Jenkins Implied Labels Plugin allows reconfiguring the plugin

MEDIUM 4.3CVE-2020-2282 · GHSA-5hw2-327v-vvr6 · Published 23/09/2020 · updated 17/06/2026

In short

CVE-2020-2282 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:implied-labels, implied labels (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.66%, higher than 51.6% of all vulnerabilities.
Fix: update to 0.7 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:implied-labels Maven	`< 0.7`	`0.7`
implied labels jenkins	`≤ 0.6`	No fix yet

Description

Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to configure the plugin.

Implied Labels Plugin 0.7 requires Overall/Administer permission to configure the plugin.

NVD description

Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to configure the plugin.

References

nvd.nist.gov/vuln/detail/CVE-2020-2282 · ADVISORY
jenkinsci/implied-labels-plugin commit 9a5d38f · WEB
jenkinsci/implied-labels-plugin · PACKAGE
jenkins.io/security/advisory/2020-09-23 · WEB
openwall.com/lists/oss-security/2020/09/23/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free