CVE-2020-2286

🗓️ 08 Oct 2020 12:40:24Reported by jenkinsType

Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration

Reporter	Title	Published	Views	Family All 10
AlpineLinux	CVE-2020-2286	8 Oct 202012:40	–	alpinelinux
CNVD	CloudBees Jenkins Role-based Authorization Strategy Plugin Privilege Obsolete Vulnerability	11 Oct 202000:00	–	cnvd
Cvelist	CVE-2020-2286	8 Oct 202012:40	–	cvelist
EUVD	EUVD-2022-1908	3 Oct 202520:07	–	euvd
Github Security Blog	Improper authorization due to caching in Jenkins Role-based Authorization Strategy Plugin	24 May 202217:30	–	github
NVD	CVE-2020-2286	8 Oct 202013:15	–	nvd
OSV	GHSA-25G4-P347-X748 Improper authorization due to caching in Jenkins Role-based Authorization Strategy Plugin	24 May 202217:30	–	osv
Prion	Default configuration	8 Oct 202013:15	–	prion
Positive Technologies	PT-2020-15516 · Jenkins · Jenkins Role-Based Authorization Strategy Plugin +1	8 Oct 202000:00	–	ptsecurity
RedhatCVE	CVE-2020-2286	22 May 202516:03	–	redhatcve

NVD

Node

jenkins role-based_authorization_strategyRange≤3.0jenkins

[
  {
    "product": "Jenkins Role-based Authorization Strategy Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2.12",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jenkins	www.jenkins.io/security/advisory/2020-10-08/
openwall	www.openwall.com/lists/oss-security/2020/10/08/5

21 Nov 2024 05:25Current

8.6High risk

Vulners AI Score8.6

CVSS 26.8

CVSS 3.18.8

EPSS0.001