SB2020110941 - Multiple vulnerabilities in Jenkins Active Directory plugin
Published: November 9, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Improper access control (CVE-ID: CVE-2020-2300)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the Windows/ADSI mode does not specifically prohibit use of empty passwords. A remote attacker can log in to Jenkins as any user by providing an empty password.
2) Cross-site request forgery (CVE-ID: CVE-2020-2303)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-2302)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to missing permission check in an HTTP endpoint. A remote user with Overall/Read permission can access the domain health check diagnostic page.
4) Improper Authentication (CVE-ID: CVE-2020-2301)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the provided password is not used when looking up an applicable cache entry when run in Windows/ADSI mode. A remote attacker can log in as any user using any password while a successful authentication of that user is still in the cache.
5) Use of hard-coded credentials (CVE-ID: CVE-2020-2299)
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded credentials in application code within the LDAP-based mode. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.
References
- http://www.openwall.com/lists/oss-security/2020/11/04/6
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2099
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2126
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1999
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2117