CVE-2020-2183
First published: Wed May 06 2020(Updated: )
Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks when determining whether a build can copy artifacts from another project build. This allows attackers, usually with Job/Configure permission, to configure jobs to copy artifacts from jobs they have no permission to access. Copy Artifact Plugin 1.44 now properly performs permission checks when copying artifacts. When updating the plugin from a previous version, the previous behavior is retained (\"Migration mode\"). To enable the additional protections, switch to the new \"Production mode\". Doing so may cause existing jobs to fail to copy artifacts. For more information see the [plugin documentation](https://github.com/jenkinsci/copyartifact-plugin).
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Copy Artifact | <=1.43.1 | |
| maven/org.jenkins-ci.plugins:copyartifact | <=1.43.1 | 1.44 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/05/06/3
- https://jenkins.io/security/advisory/2020-05-06/#SECURITY-988
- https://nvd.nist.gov/vuln/detail/CVE-2020-2183
- https://github.com/jenkinsci/copyartifact-plugin/commit/dc87de169604cb9b6706c5328e2e4aeb2c6652d6
- https://github.com/advisories/GHSA-vv89-xggx-qqh2 (Advisory)
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-vv89-xggx-qqh2
- alias/CVE-2020-2183
- collector/nvd-cve
- collector/github-advisory
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins copy artifact
- version/jenkins copy artifact/1.43.1
- package-manager/maven