CVE-2020-2090

The CVE-2020-2090 entry pertains to a CSRF vulnerability in Jenkins Amazon EC2 Plugin (versions 1.47 and earlier). The root cause is that form validation methods did not perform permission checks, allowing users with Overall/Read access to Jenkins to connect to an attacker-specified URL within th...

CVE-2020-2187

The CVE-2020-2187 issue affects Jenkins Amazon EC2 Plugin (versions 1.50.1 and earlier). The root cause is that the plugin unconditionally accepts self-signed HTTPS certificates and does not perform hostname validation when connecting to Windows agents, enabling man-in-the-middle attacks. Impact ...

CVE-2020-2091

CVE-2020-2091 concerns the Jenkins Amazon EC2 Plugin (versions 1.47 and earlier). A missing permission check in form validation allows users with Overall/Read access to connect to an attacker-specified URL in the AWS region using attacker-specified credentials IDs obtained via another method. The...

CVE-2020-2188

Summary (CVE-2020-2188) : The Jenkins Amazon EC2 Plugin (versions 1.50.1 and earlier) contains a missing permission check in form-related methods that allows any user with Overall/Read access to enumerate credentials IDs stored in Jenkins. This exposure can aid an attacker who already has basic a...

CVE-2020-2185

CVE-2020-2185 – Jenkins Amazon EC2 Plugin : Affects Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier. The issue is a lack of SSH host key validation when connecting agents, enabling potential man‑in‑the‑middle attacks. The connected Red Hat, OSV, GHSA, CNVD, and other entries corroborate the...

CVE-2020-2186

CVE-2020-2186 describes a CSRF vulnerability in the Jenkins Amazon EC2 Plugin ≤ 1.50.1, where several HTTP endpoints did not require POST, allowing an attacker to provision EC2 instances with attacker‑supplied templates. The root cause is insufficient CSRF protection on those endpoints, enabling ...