Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection

HOCH 8.0CVE-2020-2196 · GHSA-rp4x-xpgf-4xv7 · Published 03/06/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-2196 ist eine Schwachstelle (HOCH (CVSS 8.0)) in org.jenkins-ci.plugins:selenium, selenium (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.94%, höher als bei 61.0% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:selenium Maven	`≤ 3.141.59`	No fix yet
selenium jenkins	`≤ 3.141.59`	No fix yet

Description

Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints.

This allows attackers to perform the following actions:

Restart the Selenium Grid hub.
Delete or replace the plugin configuration.
Start, stop, or restart Selenium configurations on specific nodes.

Through carefully chosen configuration parameters, these actions can result in OS command injection on the Jenkins controller.

NVD description

Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.

References

nvd.nist.gov/vuln/detail/CVE-2020-2196 · ADVISORY
jenkinsci/selenium-plugin · PACKAGE
jenkins.io/security/advisory/2020-06-03 · WEB
openwall.com/lists/oss-security/2020/06/03/3 · WEB
openwall.com/lists/oss-security/2022/04/14/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Kurz gesagt

CVE-2020-2196 ist eine Schwachstelle (HOCH (CVSS 8.0)) in org.jenkins-ci.plugins:selenium, selenium (jenkins).

Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.94%, höher als bei 61.0% aller Schwachstellen.

Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:selenium

Maven

≤ 3.141.59

No fix yet

selenium

jenkins

≤ 3.141.59

No fix yet

Description

Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints.

This allows attackers to perform the following actions:

Restart the Selenium Grid hub.
Delete or replace the plugin configuration.
Start, stop, or restart Selenium configurations on specific nodes.

Through carefully chosen configuration parameters, these actions can result in OS command injection on the Jenkins controller.

NVD description

Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.