CVE-2020-2295

Vulnerability

Overview

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Maven Cascade Release Plugin, versions 1.3.2 and earlier. The plugin fails to require a CSRF token for certain HTTP endpoints, allowing an attacker to perform unauthorized actions on behalf of an authenticated Jenkins user [1][3].

Exploitation

An attacker can craft a malicious web page or link that, when visited by a Jenkins user with appropriate permissions, triggers requests to the vulnerable plugin endpoints. No direct authentication is needed for the attacker; the victim's session is used to execute the actions. The attack requires the victim to have at least Overall/Read and Job/Configure permissions for the targeted jobs [1].

Impact

Successful exploitation enables the attacker to start cascade builds and layout builds, as well as reconfigure the plugin settings. This could lead to unauthorized builds, resource consumption, or manipulation of the release process [1][3].

Mitigation

As of the advisory publication date (2020-10-08), no fixed version of the plugin was available. The plugin was listed as an unresolved security issue [3]. Users are advised to disable the plugin if not needed, or restrict access to Jenkins to trusted users only [1].