CVE-2020-2103: Infoleak
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
Other sources
Jenkins shows various technical details about the current user on the /whoAmI page. In a previous fix, the Cookie header value containing the HTTP session ID was redacted. However, user metadata shown on this page could also include the HTTP session ID in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier.
This allows attackers able to exploit a cross-site scripting vulnerability to obtain the HTTP session ID value from this page.
Jenkins 2.219, LTS 2.204.2 no longer prints out the affected user metadata that might contain the HTTP session ID.
Additionally, we also redact values of further authentication-related HTTP headers in addition to Cookie on this page as a hardening.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.204.2 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.219 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.219 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.204.2 - Configuration
Apply the hardening/redaction so that authentication-related HTTP header values (including the `Cookie` header value containing the HTTP session ID) are redacted on the Jenkins `/whoAmI` page; this was introduced/covered in the previous fix for `Cookie` in the SECURITY-1505 advisory.
Jenkins /whoAmI diagnostic page Redaction of authentication-related HTTP header values (including Cookie) = Redact HTTP session identifier from authentication-related headers
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2103?
CVE-2020-2103 is classified as a medium severity vulnerability.
How do I fix CVE-2020-2103?
To fix CVE-2020-2103, upgrade Jenkins to version 2.204.2 or 2.219 or later.
What versions of Jenkins are affected by CVE-2020-2103?
Jenkins versions 2.218 and earlier, as well as LTS versions 2.204.1 and earlier are affected by CVE-2020-2103.
What does CVE-2020-2103 expose?
CVE-2020-2103 exposes session identifiers on the user's detail object in the whoAmI diagnostic page.
Is there a workaround for CVE-2020-2103?
There is no documented workaround for CVE-2020-2103; updating to a secure version is the recommended solution.