GHSA-w6hw-57jq-h7f5

    Dashboard / Vulnerabilities / GHSA-w6hw-57jq-h7f5

    GHSA-w6hw-57jq-h7f5

    Published: 24 May 2022Last Modified: 16 Feb 2024
    Aliases:
    CVE-2020-2186

    Summary: CSRF vulnerability in Amazon EC2 Plugin

    Details: Amazon EC2 Plugin 1.50.1 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows an attacker to provision instances with an attacker-specified template ID. Amazon EC2 Plugin 1.50.2 now requires POST requests for the affected HTTP endpoints.

    References: https://nvd.nist.gov/vuln/detail/CVE-2020-2186, https://github.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358, https://github.com/jenkinsci/ec2-plugin, https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1408, http://www.openwall.com/lists/oss-security/2020/05/06/3

    Affected packages

    Package

    Name: org.jenkins-ci.plugins:ec2

    Purl: pkg:maven/org.jenkins-ci.plugins/ec2

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.50.2

    Affected versions

    1.11

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-w6hw-57jq-h7f5 | CVE-DB