CVE-2020-2196

HIGH

8.0

Description

Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.

Details CVE

Score CVSS v3.18.0

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurREQUIRED

Publie6/3/2020

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

jenkins:selenium

Faiblesses (CWE)

CWE-352

References

http://www.openwall.com/lists/oss-security/2020/06/03/3(jenkinsci-cert@googlegroups.com)

http://www.openwall.com/lists/oss-security/2022/04/14/2(jenkinsci-cert@googlegroups.com)

https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766(jenkinsci-cert@googlegroups.com)

http://www.openwall.com/lists/oss-security/2020/06/03/3(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2022/04/14/2(af854a3a-2127-422b-91ae-364da2661108)

https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.