Lucene search

JenkinsCVE-2020-2323

HistoryDec 03, 2020 - 4:15 p.m.

CVE-2020-2323

2020-12-0316:15:12

CWE-862

jenkins

web.nvd.nist.gov

cve-2020-2323

jenkins chaos monkey plugin

unauthorized access

permission checks

http endpoint

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

32.6%

JSON

Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions.

Affected configurations

Nvd

Node

netflixchaos_monkeyRange≤0.4jenkins

VendorProductVersionCPE
netflixchaos_monkey*cpe:2.3:a:netflix:chaos_monkey:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
netflix	chaos_monkey	*	cpe:2.3:a:netflix:chaos_monkey::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Chaos Monkey Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "0.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2020/12/03/2

www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%282%29

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

32.6%

JSON

Related for CVE-2020-2323