{"id":"CVE-2020-2255","aliases":["EUVD-2022-5335","GHSA-vc7g-4269-f7hw","RHSA-2020:4297","RHSA-2020:5102"],"status":"published","title":"Missing permission check in Blue Ocean Plugin","description":"A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00865,"percentile":0.58901,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2020-09-16T13:20:40Z","modified":"2026-10-24T10:30:23Z","fixes":[{"ecosystem":"Maven","package":"io.jenkins.blueocean:blueocean","fixed_in":["1.23.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.jenkins.blueocean:blueocean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.23.2"},{"fixed":"1.23.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.jenkins.blueocean:blueocean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.3"}]}],"versions":["1.0-alpha-1","1.0-alpha-2","1.0-alpha-3","1.0-alpha-4","1.0-alpha-5","1.0-alpha-6","1.0-alpha-7","1.0-alpha-8","1.0-alpha-9","1.0.0","1.0.0-b01","1.0.0-b02","1.0.0-b03","1.0.0-b04","1.0.0-b05","1.0.0-b06","1.0.0-b07","1.0.0-b08","1.0.0-b09","1.0.0-b10","1.0.0-b11","1.0.0-b12","1.0.0-b13","1.0.0-b14","1.0.0-b15","1.0.0-b16","1.0.0-b17","1.0.0-b18","1.0.0-b19","1.0.0-b19-beta-1","1.0.0-b20","1.0.0-b20-beta-1","1.0.0-b21","1.0.0-b21-beta-1","1.0.0-b22","1.0.0-b23","1.0.0-b24","1.0.0-b25","1.0.0-rc1","1.0.0-rc2","1.0.0-rc3","1.0.0-rc4","1.0.1","1.1.0","1.1.0-beta-1","1.1.0-beta-2","1.1.0-beta-4","1.1.0-beta-8","1.1.0-beta-9","1.1.1","1.1.2","1.1.4","1.1.5","1.1.6","1.1.7","1.10.1","1.10.2","1.11.0","1.11.1","1.13.0","1.13.1","1.13.2","1.14.0","1.15.0","1.15.1","1.16.0","1.17.0","1.18.0","1.18.1","1.19.0","1.19.1","1.19.2","1.2.0","1.2.0-beta-1","1.2.0-beta-3","1.2.0-beta-4","1.2.0-beta-5","1.2.0-beta-6","1.2.0-beta-7","1.2.1","1.2.2","1.2.3","1.2.4","1.21.0","1.22.0","1.23.0","1.23.1","1.23.2","1.3.0","1.3.0-beta-1","1.3.0-beta-2","1.3.0-beta-3","1.3.0-beta-4","1.3.0-beta-5","1.3.0-beta-6","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.4.0","1.4.0-beta-3","1.4.0-beta-4","1.4.0-beta-5","1.4.1","1.4.2","1.5.0","1.5.0-beta-1","1.5.0-beta-2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0-beta-1","1.6.0-beta-3","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.8.0","1.8.2","1.8.3","1.8.4","1.9.0","1.9.1"]},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.1601368321-1.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202010081244.p0.git.3794.4743d24.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202010081244.p0.git.3794.4743d24.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202010081244.p0.git.3794.4743d24.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202010081244.p0.git.3794.4743d24.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1-2.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3-3.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3-3.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3-3.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3-3.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3-3.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3-3.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3-3.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1-2.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1-2.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1-2.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1-2.rhaos4.6.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-81.rhaos4.6.git5b757d4.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-81.rhaos4.6.git5b757d4.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-81.rhaos4.6.git5b757d4.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-81.rhaos4.6.git5b757d4.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-81.rhaos4.6.git5b757d4.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1603460090-1.el7"}]}],"bundled":3}],"products":[{"vendor":"jenkins","product":"blue_ocean"},{"vendor":"jenkins project","product":"jenkins blue ocean plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1961","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2020/09/16/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2255","tags":["advisory"]},{"url":"https://github.com/jenkinsci/blueocean-plugin/commit/659a66aff0d0ad693eab9d2807985d591e102aab","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vc7g-4269-f7hw"},{"url":"https://access.redhat.com/errata/RHSA-2020:4297","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1853652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1867099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1874268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1880454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1880456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1880460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1886637","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4297.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16541","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1106","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2252","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2020/09/16/3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2254","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1956","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2255","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8564","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/issues/95622","tags":["article"]},{"url":"https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14040","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/39491","tags":["article"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14370","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14370","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15586","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856953","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15586","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w/m/E6gHDs32AQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-16845","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-16845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16845","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/NyPIaucMgXo","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5102","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5102.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-2255","description":"A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.","status":"published","published":"2020-09-16T13:20:40Z","modified":"2024-08-04T07:01:41.23Z","updated_at":"2026-11-02T14:35:51.206854Z"}],"euvd":[{"id":"EUVD-2022-5335","description":"A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.","status":"published","published":"2020-09-16T13:20:40Z","modified":"2024-08-04T07:01:41Z","updated_at":"2026-11-03T03:08:09.929524Z"}],"ghsa":[{"id":"GHSA-vc7g-4269-f7hw","title":"Missing permission check in Blue Ocean Plugin","description":"### Updated 2020-09-16\nThis entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it.\n\n### Original Description\nBlue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL.\n\nBlue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.","status":"published","published":"2022-05-24T17:28:25Z","modified":"2023-12-20T13:43:02Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:37:27.414424Z"}],"nvd":[{"id":"CVE-2020-2255","description":"A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.","status":"published","published":"2020-09-16T14:15:13.237Z","modified":"2026-06-17T03:12:05.04Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"CVE-2020-2255","description":"A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.","status":"published","published":"2020-09-16T14:15:13.237Z","modified":"2026-10-24T10:30:23.177727274Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"GHSA-vc7g-4269-f7hw","title":"Missing permission check in Blue Ocean Plugin","description":"### Updated 2020-09-16\nThis entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it.\n\n### Original Description\nBlue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL.\n\nBlue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.","status":"published","published":"2022-05-24T17:28:25Z","modified":"2024-02-16T08:09:23.296081Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"RHSA-2020:4297","title":"Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update","status":"published","published":"2024-09-30T13:54:04Z","modified":"2026-10-14T10:01:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5102","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11.318 jenkins-2-plugins security update","status":"published","published":"2024-09-16T04:55:47Z","modified":"2025-11-22T12:12:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"}]}}