CVE-2020-2254 Path traversal vulnerability in Blue Ocean Plugin

What is CVE-2020-2254?

CVE-2020-2254 is a medium-severity path traversal vulnerability in Jenkins Blue Ocean Plugin, published on 16 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system.

Weakness: CWE-22

Which versions are affected by CVE-2020-2254?

2 open source packages ship an affected version, including io.jenkins.blueocean:blueocean. It affects 1 product.

Products include Jenkins Blue Ocean.

How do I fix CVE-2020-2254?

Upgrade io.jenkins.blueocean:blueocean to 1.23.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-2254 being exploited?

There is no known exploitation of CVE-2020-2254 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Blue Ocean Plugin

• CVE-2023-40341 Jenkins Blue Ocean Plugin cross-site request forgery vulnerability High 8.8
• CVE-2017-1000106 Improper Authentication in Jenkins Blue Ocean Plugin High 8.5
• CVE-2022-30952 Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin Medium 6.5
• CVE-2022-30953 Cross Site Request Forgery in Jenkins Blue Ocean Plugin Medium 6.5
• CVE-2022-30954 Missing permission check in Jenkins Blue Ocean Plugin Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vq7j-6pcq-f48p.