CVE-2020-2309 Missing authorization in Jenkins Kubernetes Plugin

What is CVE-2020-2309?

CVE-2020-2309 is a medium-severity vulnerability in Jenkins Kubernetes Plugin, published on 4 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Which versions are affected by CVE-2020-2309?

8 open source packages ship an affected version, including org.csanchez.jenkins.plugins:kubernetes. It affects 1 product.

Products include Jenkins Kubernetes.

How do I fix CVE-2020-2309?

Upgrade org.csanchez.jenkins.plugins:kubernetes to a fixed version for your release line: 1.21.6, 1.25.4.1, 1.26.5 or 1.27.4.

Is CVE-2020-2309 being exploited?

There is no known exploitation of CVE-2020-2309 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Kubernetes Plugin

• CVE-2018-1999040 Exposure of Sensitive Information in Jenkins Kubernetes Plugin High 8.8
• CVE-2023-30513 Jenkins Kubernetes Plugin does not properly mask credentials High 7.5
• CVE-2018-1000187 Exposure of Sensitive Information in Jenkins Kubernetes Plugin Medium 6.5
• CVE-2021-21661 Missing Authorization in Jenkins Kubernetes CLI Plugin Medium 4.3
• CVE-2020-2307 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g2r3-4g8q-h5rj.