CVE-2020-2308 Missing Authorization in Jenkins Kubernetes Plugin

What is CVE-2020-2308?

CVE-2020-2308 is a medium-severity missing authorization vulnerability in Jenkins Kubernetes Plugin, published on 4 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names.

Which versions are affected by CVE-2020-2308?

8 open source packages ship an affected version, including org.csanchez.jenkins.plugins:kubernetes. It affects 1 product.

Products include Jenkins Kubernetes.

How do I fix CVE-2020-2308?

Upgrade org.csanchez.jenkins.plugins:kubernetes to a fixed version for your release line: 1.21.6, 1.25.4.1, 1.26.5 or 1.27.4.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-2308 being exploited?

There is no known exploitation of CVE-2020-2308 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Kubernetes Plugin

• CVE-2018-1999040 Exposure of Sensitive Information in Jenkins Kubernetes Plugin High 8.8
• CVE-2023-30513 Jenkins Kubernetes Plugin does not properly mask credentials High 7.5
• CVE-2018-1000187 Exposure of Sensitive Information in Jenkins Kubernetes Plugin Medium 6.5
• CVE-2021-21661 Missing Authorization in Jenkins Kubernetes CLI Plugin Medium 4.3
• CVE-2020-2307 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rr6j-37cv-c7x7.