medium5.3
CVE-2020-2323
Missing permission checks in Jenkins Chaos Monkey Plugin
Impact
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint. This allows attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions. Jenkins Chaos Monkey Plugin 0.4.1 requires Overall/Administer permission to access the Chaos Monkey page and to see the history of actions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:chaos-monkey | <= 0.4 | 0.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netflix | Chaos Monkey | through 0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2020/12/03/2
- https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%282%29
- https://github.com/advisories/GHSA-hx53-635r-vmv8
- https://nvd.nist.gov/vuln/detail/CVE-2020-2323
- https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20(2)