CVE-2020-2311

2020-11-0415:15:11

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.1%

JSON

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration.

CPENameOperatorVersion
aws-global-configuration-plugineqaws-global-configuration-1.2
aws-global-configuration-plugineqaws-global-configuration-1.0
aws-global-configuration-plugineqaws-global-configuration-1.5
aws-global-configuration-plugineqaws-global-configuration-1.4
aws-global-configuration-plugineqaws-global-configuration-1.1
aws-global-configuration-plugineqaws-global-configuration-1.1.1
aws-global-configuration-plugineqaws-global-configuration-1.3

Name	Operator	Version
aws-global-configuration-plugin	eq	aws-global-configuration-1.2
aws-global-configuration-plugin	eq	aws-global-configuration-1.0
aws-global-configuration-plugin	eq	aws-global-configuration-1.5
aws-global-configuration-plugin	eq	aws-global-configuration-1.4
aws-global-configuration-plugin	eq	aws-global-configuration-1.1
aws-global-configuration-plugin	eq	aws-global-configuration-1.1.1
aws-global-configuration-plugin	eq	aws-global-configuration-1.3

References

www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2101