Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-2302

CVE-2020-2302: Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-2302
GHSA ID
GHSA-q6rq-4whr-r879
EPSS Score
0.07093%
CWE
CWE-862
Published
5/24/2022
Updated
12/14/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:active-directorymaven< 2.202.20

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the ActiveDirectoryStatus class handling the domain health check endpoint without proper authorization. In versions ≤2.19, the class did not implement StaplerProxy or override getRequiredPermission(), allowing access with Overall/Read permissions. The fix in 2.20 added getTarget() (to enforce permission checks via checkPermission()) and getRequiredPermission() (to require ADMINISTER), which were missing in vulnerable versions. The class itself acts as the entry point for the insecure endpoint, making it the core vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins **tiv* *ir**tory Plu*in *.** *n* **rli*r *o*s not p*r*orm * p*rmission ****k in *n *TTP *n*point. T*is *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to ****ss t** *om*in ***lt* ****k *i**nosti* p***. J*nkins **tiv* *ir**tory Plu*in *.** r*q

Reasoning

T** vuln*r**ility st*ms *rom t** `**tiv**ir**torySt*tus` *l*ss **n*lin* t** *om*in ***lt* ****k *n*point wit*out prop*r *ut*oriz*tion. In v*rsions ≤*.**, t** *l*ss *i* not impl*m*nt `St*pl*rProxy` or ov*rri** `**tR*quir**P*rmission()`, *llowin* ****s