CVE-2020-2235

Vulnerability

Overview The Pipeline Maven Integration Plugin up to version 3.8.2 contains a cross-site request forgery (CSRF) vulnerability. The plugin fails to require a CSRF token for endpoints that configure JDBC connections, allowing an attacker to forge requests from a victim user.

Exploitation

An attacker can trick a Jenkins user with sufficient permissions into clicking a crafted link or visiting a malicious page. This triggers a request to the plugin's configuration endpoint, causing the victim's browser to submit a new JDBC URL and credential ID chosen by the attacker. The attacker must first obtain a valid credential ID through other means (e.g., another vulnerability or reconnaissance).

Impact

If successful, the attacker can connect Jenkins to an attacker-controlled database server. This could be leveraged to capture credentials stored in Jenkins, as the plugin may transmit them during the connection attempt. The vulnerability has a CVSS score of 8.0, indicating high severity [2].

Mitigation

The vulnerability is fixed in Pipeline Maven Integration Plugin version 3.8.3 [3][4]. Users should update immediately. As a workaround, ensure that only trusted users have access to Jenkins and consider restricting network access to prevent outbound connections to arbitrary JDBC URLs.