high7.5
CVE-2020-2322
Missing permission checks in Jenkins Chaos Monkey Plugin
Impact
Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to generate load and to generate memory leaks. Jenkins Chaos Monkey Plugin 0.4 requires Overall/Administer permission to generate load and to generate memory leaks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:chaos-monkey | <= 0.3 | 0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netflix | Chaos Monkey | through 0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2020/12/03/2
- https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%281%29
- https://github.com/advisories/GHSA-mr75-899x-qcxq
- https://nvd.nist.gov/vuln/detail/CVE-2020-2322
- https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20(1)