CVE-2020-2188 Users with Overall/Read access can enumerate credentials IDs in Amazon EC2 Plugin
MediumCVSS 4.3
EPSS 0.65%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins/ec2(Maven) | <= 1.50.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | < 1.50.2 | 1.50.2 |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.11 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.12 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.13 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.14 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.15 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.16 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.17 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.18 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.19 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.20 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.21 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.22 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.23 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.24 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.25 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.26 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.27 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.28 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.29 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.30 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.31 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.32 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.33 | No fix listed |
Show 32 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins/ec2(Maven) | = 1.34 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.35 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.36 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.37 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.38 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.39 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.40 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.40.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.41 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.41.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.42 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.42.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.42.2 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.43 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.44 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.44.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.45 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46.2 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46.3 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.46.4 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.47 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.48 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.49 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.49.1 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.49.2 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.49.3 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.50 | No fix listed |
| org.jenkins-ci.plugins/ec2(Maven) | = 1.50.1 | No fix listed |
| jenkins amazon ec2 | <= 1.50.1 | No fix listed |
| Jenkins Project Jenkins Amazon EC2 Plugin | <= 1.50.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- jenkins.io vendor-advisory
- [oss-security] 20200506 Multiple vulnerabilities in Jenkins plugins mailing-list third-party-advisory
- github.com
- github.com product