CVE-2020-2117

2020-02-12T15:15:00
ID CVE-2020-2117
Type cve
Reporter jenkinsci-cert@googlegroups.com
Modified 2020-02-14T17:57:00

Description

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.