Missing permission checks in Jenkins Amazon EC2 Plugin

高 8.1CVE-2020-2091 · GHSA-6hmm-77r2-h6hr · 15/01/2020 公開 · 17/06/2026 更新

要点

CVE-2020-2091 は org.jenkins-ci.plugins:ec2, amazon ec2 (jenkins) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 66.6% より高い）。
対処：1.48 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:ec2 Maven	`< 1.48`	`1.48`
amazon ec2 jenkins	`≤ 1.47`	修正版なし

概要

Amazon EC2 Plugin 1.47 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.

This vulnerability might also allow attackers to capture credentials stored in Jenkins. We have not been able to confirm that this is possible.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

Amazon EC2 Plugin 1.48 requires POST requests and Overall/Administer permission for the affected form validation methods.

NVD の説明

A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.