CVE-2020-2287 Request logging bypass in Jenkins Audit Trail Plugin
Attackers can bypass request logging in Jenkins Audit Trail Plugin by crafting URLs that exploit pattern matching discrepancies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-2287?
CVE-2020-2287 is a medium-severity vulnerability in Jenkins Audit Trail Plugin, published on 8 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web framework uses for dispatching requests, which allows attackers to craft URLs that bypass request logging of any target URL.
Which versions are affected by CVE-2020-2287?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:audit-trail. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:audit-trail Maven | All versions | 3.7 |
org.jenkins-ci.plugins:audit-trail Maven | All versions | 3.7 |
Products include Jenkins Audit Trail.
How do I fix CVE-2020-2287?
Upgrade org.jenkins-ci.plugins:audit-trail to 3.7 or later.
Is CVE-2020-2287 being exploited?
There is no known exploitation of CVE-2020-2287 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Audit Trail Plugin
Sources
Also known as GHSA-rpj6-2q8r-98f8.