Improper authorization due to caching in Jenkins Role-based Authorization Strategy Plugin

高 8.8CVE-2020-2286 · GHSA-25g4-p347-x748 · 08/10/2020 公開 · 17/06/2026 更新

要点

CVE-2020-2286 は org.jenkins-ci.plugins:role-strategy, role-based authorization strategy (jenkins) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.3%（全脆弱性の 69.9% より高い）。
対処：3.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:role-strategy Maven	`≥ 2.12, < 3.1`	`3.1`
role-based authorization strategy jenkins	`≤ 3.0`	修正版なし

概要

Role-based Authorization Strategy Plugin 2.12 and newer uses a cache to speed up permission lookups. Role-based Authorization Strategy Plugin 3.0 and earlier this cache is not invalidated properly when an administrator changes the permission configuration. This can result in permissions being granted long after the configuration was changed to no longer grant them. Role-based Authorization Strategy Plugin 3.1 properly invalidates the cache on configuration changes.

NVD の説明

Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration.