Missing permission check in Jenkins AWS Global Configuration Plugin allows replacing plugin configuration

MEDIUM 4.3CVE-2020-2311 · GHSA-7v7g-mh53-89hw · Published 04/11/2020 · updated 17/06/2026

In short

CVE-2020-2311 is a MEDIUM (CVSS 4.3) vulnerability affecting io.jenkins.plugins:aws-global-configuration, aws global configuration (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.83%, higher than 57.6% of all vulnerabilities.
Fix: update to 1.6 or later.

Package	Affected versions	Patched versions
io.jenkins.plugins:aws-global-configuration Maven	`< 1.6`	`1.6`
aws global configuration jenkins	`≤ 1.5`	No fix yet

Description

Jenkins AWS Global Configuration Plugin 1.5 and earlier does not perform a permission check in an HTTP endpoint processing form submissions.

This allows attackers with Overall/Read permission to replace the global AWS configuration.

Jenkins AWS Global Configuration Plugin 1.6 properly performs permission checks when processing configuration form submissions.

NVD description

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration.

References

nvd.nist.gov/vuln/detail/CVE-2020-2311 · ADVISORY
jenkinsci/aws-global-configuration-plugin commit 783618f · WEB
jenkinsci/aws-global-configuration-plugin · PACKAGE
jenkins.io/security/advisory/2020-11-04 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free