5.3

CVSS Score

3.1

Basic Information

CVE ID

CVE-2020-2268

GHSA ID

GHSA-j6p9-hm3q-hwmj

EPSS Score

0.26173%

CWE

CWE-352

Published

5/24/2022

Updated

1/9/2024

KEV Status

Technology

Java

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2020-2268

CVE-2020-2268: CSRF vulnerability in MongoDB Plugin

Jenkins MongoDB Plugin 1.3 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

(GitHub Advisory)

5.3

CVSS Score

3.1

Basic Information

CVE ID

CVE-2020-2268

GHSA ID

GHSA-j6p9-hm3q-hwmj

EPSS Score

0.26173%

CWE

CWE-352

Published

5/24/2022

Updated

1/9/2024

KEV Status

Technology

Java

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:mongodb	maven	<= 1.3

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

J*nkins Mon*o** Plu*in *.* *n* **rli*r *o*s not p*r*orm p*rmission ****ks in m*t*o*s impl*m*ntin* *orm v*li**tion. T*is *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to **in ****ss to som* m*t***t* o* *ny *r*itr*ry *il*s on t** J*nkins *ontroll*r.

Reasoning

No *n*lysis *v*il**l*

5.3

Basic Information

Concerned about an active attack path?

CVE-2020-2268: CSRF vulnerability in MongoDB Plugin

5.3

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI