Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-2183

CVE-2020-2183: Improper permission checks in Jenkins Copy Artifact Plugin

5.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2020-2183
GHSA ID
GHSA-vv89-xggx-qqh2
EPSS Score
0.1451%
CWE
CWE-276
Published
5/24/2022
Updated
12/22/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:copyartifactmaven<= 1.43.11.44

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key issues: 1) Improper validation() during job configuration where parameterized project names bypassed security checks, and 2) Insufficient runtime permission checks when actually copying artifacts. The canReadFrom method's original implementation used weak 'authenticated anonymous' checks and didn't properly integrate with Jenkins' security systems. The perform method lacked the critical canReadArtifact check added in the patch that enforces Run.ARTIFACTS permissions. The commit diff shows significant security enhancements in both methods, including the introduction of production/migration modes and proper ACL checks.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*opy *rti***t Plu*in *.**.* *n* **rli*r p*r*orms improp*r p*rmission ****ks w**n **t*rminin* w**t**r * *uil* **n *opy *rti***ts *rom *not**r proj**t *uil*. T*is *llows *tt**k*rs, usu*lly wit* Jo*/*on*i*ur* p*rmission, to *on*i*ur* jo*s to *opy *rti**

Reasoning

T** vuln*r**ility st*ms *rom two k*y issu*s: *) Improp*r `v*li**tion()` *urin* jo* *on*i*ur*tion w**r* p*r*m*t*riz** proj**t n*m*s *yp*ss** s**urity ****ks, *n* *) Insu**i*i*nt runtim* p*rmission ****ks w**n **tu*lly *opyin* *rti***ts. T** `**nR****r