CVE-2020-2272

2020-09-1614:15:14

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

CPENameOperatorVersion
elastest-plugineqelastest-1.0.0-beta9
elastest-plugineqelastest-1.0-beta1
elastest-plugineqelastest-1.0.0-beta7
elastest-plugineqelastest-0.9.1
elastest-plugineqelastest-0.10.0-beta2
elastest-plugineqelastest-1.0-beta4
elastest-plugineqelastest-1.2.1
elastest-plugineqelastest-0.10
elastest-plugineqelastest-0.10.0-beta1
elastest-plugineqelastest-0.9.1-beta-4

Name	Operator	Version
elastest-plugin	eq	elastest-1.0.0-beta9
elastest-plugin	eq	elastest-1.0-beta1
elastest-plugin	eq	elastest-1.0.0-beta7
elastest-plugin	eq	elastest-0.9.1
elastest-plugin	eq	elastest-0.10.0-beta2
elastest-plugin	eq	elastest-1.0-beta4
elastest-plugin	eq	elastest-1.2.1
elastest-plugin	eq	elastest-0.10
elastest-plugin	eq	elastest-0.10.0-beta1
elastest-plugin	eq	elastest-0.9.1-beta-4