Missing permission check in Jenkins Pipeline Maven Integration Plugin allow capturing credentials

中 6.5CVE-2020-2234 · GHSA-mrr8-fcg7-p2wg · 12/08/2020 公開 · 17/06/2026 更新

要点

CVE-2020-2234 は org.jenkins-ci.plugins:pipeline-maven, pipeline maven integration (jenkins) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 64.5% より高い）。
対処：3.8.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:pipeline-maven Maven	`< 3.8.3`	`3.8.3`
pipeline maven integration jenkins	`≤ 3.8.2`	修正版なし

概要

Pipeline Maven Integration Plugin 3.8.2 and earlier does not perform a permission check in a method implementing form validation.

This allows users with Overall/Read access to Jenkins to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Pipeline Maven Integration Plugin 3.8.3 requires POST requests and Job/Configure permission for the affected form validation method.

NVD の説明

A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.