Improper Authentication Affecting org.jenkins-ci.plugins:audit-trail package, versions [,3.7)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-1016918
- published 9 Oct 2020
- disclosed 9 Oct 2020
- credit Daniel Beck, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc.
Introduced: 9 Oct 2020
CVE-2020-2287 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.plugins:audit-trail
to version 3.7 or higher.
Overview
org.jenkins-ci.plugins:audit-trail is a Jenkins plugin that keeps a log of who performed particular Jenkins operations, such as configuring jobs.
Affected versions of this package are vulnerable to Improper Authentication. It logs requests whose URL path matches an admin-configured regular expression.A discrepancy between the behavior of the plugin and the Stapler web framework in parsing URL paths allows attackers to craft URLs that would bypass request logging in Audit Trail Plugin 3.6 and earlier. This only applies to Jenkins 2.227 and earlier, LTS 2.204.5 and earlier, as the fix for Audit Trail Plugin 3.7 processes request URL paths the same way as the Stapler web framework.