CVE-2020-2091 Missing permission checks in Jenkins Amazon EC2 Plugin
HighCVSS 8.1
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins/ec2(Maven) | < 1.48 | 1.48 |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.11 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.12 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.13 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.14 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.15 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.16 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.17 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.18 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.19 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.20 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.21 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.22 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.23 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.24 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.25 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.26 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.27 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.28 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.29 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.30 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.31 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.32 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.33 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.34 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins/ec2(Maven) | = 1.35 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.36 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.37 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.38 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.39 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.40 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.40.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.41 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.41.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.42 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.42.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.42.2 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.43 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.44 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.44.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.45 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46.2 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46.3 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46.4 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.47 | No fix listed |
| jenkins amazon ec2 | <= 1.47 | No fix listed |
| Jenkins Project Jenkins Amazon EC2 Plugin | <= 1.47 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- jenkins.io vendor-advisory
- github.com patch
- github.com
- github.com product