CVE-2020-2255
Missing permission check in Blue Ocean Plugin
A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
- Record
CVE-2020-2255- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
- Record
CVE-2020-2255- Updated
- 2026-11-02
EUVDEUVD-2022-5335 No score
A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
- Record
EUVD-2022-5335- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vc7g-4269-f7hw
Missing permission check in Blue Ocean Plugin
Updated 2020-09-16
This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it.
Original Description
Blue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Blue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.
- Record
GHSA-vc7g-4269-f7hw- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
- Record
CVE-2020-2255- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-vc7g-4269-f7hw
Missing permission check in Blue Ocean Plugin
Updated 2020-09-16
This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it.
Original Description
Blue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Blue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.
- Record
GHSA-vc7g-4269-f7hw- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVRHSA-2020:4297
Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update
- Record
RHSA-2020:4297- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:5102
Red Hat Security Advisory: OpenShift Container Platform 3.11.318 jenkins-2-plugins security update
- Record
RHSA-2020:5102- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.blueocean:blueoceanMaven |
through 1.23.2 | 1.23.3 |
io.jenkins.blueocean:blueoceanMaven |
before 1.23.3, plus listed versions 1.0-alpha-11.0-alpha-21.0-alpha-31.0-alpha-41.0-alpha-5 Show 45 moreShow less1.0-alpha-61.0-alpha-71.0-alpha-81.0-alpha-91.0.01.0.0-b011.0.0-b021.0.0-b031.0.0-b041.0.0-b051.0.0-b061.0.0-b071.0.0-b081.0.0-b091.0.0-b101.0.0-b111.0.0-b121.0.0-b131.0.0-b141.0.0-b151.0.0-b161.0.0-b171.0.0-b181.0.0-b191.0.0-b19-beta-11.0.0-b201.0.0-b20-beta-11.0.0-b211.0.0-b21-beta-11.0.0-b221.0.0-b231.0.0-b241.0.0-b251.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.11.1.01.1.0-beta-11.1.0-beta-21.1.0-beta-41.1.0-beta-81.1.0-beta-91.1.1 |
1.23.3 |
jenkins-2-pluginsRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:4.6.1601368321-1.el8 | 0:4.6.1601368321-1.el8 |
openshift-clientsRed Hat:openshift:4.6::el7 From an advisory covering 9 CVEs |
before 0:4.6.0-202010081244.p0.git.3794.4743d24.el7 | 0:4.6.0-202010081244.p0.git.3794.4743d24.el7 |
openshift-clients-redistributableRed Hat:openshift:4.6::el7 From an advisory covering 9 CVEs |
before 0:4.6.0-202010081244.p0.git.3794.4743d24.el7 | 0:4.6.0-202010081244.p0.git.3794.4743d24.el7 |
openshift-clientsRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 | 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 |
openshift-clients-redistributableRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 | 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 |
containers-commonRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 1:1.1.1-2.rhaos4.6.el8 | 1:1.1.1-2.rhaos4.6.el8 |
podmanRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.9.3-3.rhaos4.6.el8 | 0:1.9.3-3.rhaos4.6.el8 |
podman-debuginfoRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.9.3-3.rhaos4.6.el8 | 0:1.9.3-3.rhaos4.6.el8 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
podman-debugsourceRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.9.3-3.rhaos4.6.el8 | 0:1.9.3-3.rhaos4.6.el8 |
podman-dockerRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.9.3-3.rhaos4.6.el8 | 0:1.9.3-3.rhaos4.6.el8 |
podman-remoteRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.9.3-3.rhaos4.6.el8 | 0:1.9.3-3.rhaos4.6.el8 |
podman-remote-debuginfoRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.9.3-3.rhaos4.6.el8 | 0:1.9.3-3.rhaos4.6.el8 |
podman-testsRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.9.3-3.rhaos4.6.el8 | 0:1.9.3-3.rhaos4.6.el8 |
skopeoRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 1:1.1.1-2.rhaos4.6.el8 | 1:1.1.1-2.rhaos4.6.el8 |
skopeo-debuginfoRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 1:1.1.1-2.rhaos4.6.el8 | 1:1.1.1-2.rhaos4.6.el8 |
skopeo-debugsourceRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 1:1.1.1-2.rhaos4.6.el8 | 1:1.1.1-2.rhaos4.6.el8 |
skopeo-testsRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 1:1.1.1-2.rhaos4.6.el8 | 1:1.1.1-2.rhaos4.6.el8 |
runcRed Hat:openshift:4.6::el7 From an advisory covering 9 CVEs |
before 0:1.0.0-81.rhaos4.6.git5b757d4.el7 | 0:1.0.0-81.rhaos4.6.git5b757d4.el7 |
runc-debuginfoRed Hat:openshift:4.6::el7 From an advisory covering 9 CVEs |
before 0:1.0.0-81.rhaos4.6.git5b757d4.el7 | 0:1.0.0-81.rhaos4.6.git5b757d4.el7 |
runcRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.0.0-81.rhaos4.6.git5b757d4.el8 | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
runc-debuginfoRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.0.0-81.rhaos4.6.git5b757d4.el8 | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
runc-debugsourceRed Hat:openshift:4.6::el8 From an advisory covering 9 CVEs |
before 0:1.0.0-81.rhaos4.6.git5b757d4.el8 | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.1603460090-1.el7 | 0:3.11.1603460090-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2255 is a medium vulnerability (CVSS 4.3) in Jenkins Blue Ocean, published September 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in io.jenkins.blueocean:blueocean 1.23.3.
References
jenkins.io/security/advisory/2020-09-16
openwall.com/lists/oss-security/2020/09/16/3
nvd.nist.gov/vuln/detail/CVE-2020-2255
github.com/jenkinsci/blueocean-plugin/commit/659a66aff0d0ad693eab9d2807985d591e102aab
access.redhat.com/errata/RHSA-2020:4297
Show 46 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1819663
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4297.json
cve.org/CVERecord?id=CVE-2019-16541
jenkins.io/security/advisory/2019-11-21
groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
Left out here: 79 versions. The JSON record has them.