Skip to content

Users with Overall/Read access can enumerate credentials IDs in Amazon EC2 Plugin

Moderate severity GitHub Reviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

maven org.jenkins-ci.plugins:ec2 (Maven)

Affected versions

<= 1.50.1

Patched versions

1.50.2

Description

Amazon EC2 Plugin provides a list of applicable credentials IDs to allow users configuring the plugin to select the one to use.

This functionality does not correctly check permissions in Amazon EC2 Plugin 1.50.1 and earlier, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Amazon EC2 Plugin 1.50.2 now requires Overall/Administer permission.

References

Published by the National Vulnerability Database May 6, 2020
Published to the GitHub Advisory Database May 24, 2022
Reviewed Dec 16, 2022
Last updated Feb 1, 2023

Severity

Moderate
4.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVE ID

CVE-2020-2188

GHSA ID

GHSA-rmp9-mc8w-mqf3

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.