CVE-2020-2118: 
Java vulnerability analysis and mitigation

CVE-2020-2118 affects the Pipeline GitHub Notify Step Plugin version 1.0.4 and earlier. The vulnerability was discovered and disclosed on February 12, 2020. The issue involves improper permission checking in the plugin's credential ID listing functionality (Jenkins Advisory).

The vulnerability exists in the credential ID listing functionality of Pipeline GitHub Notify Step Plugin. The plugin provides a list of applicable credential IDs to allow users configuring the plugin to select credentials, but does not correctly check permissions. This allows any user with Overall/Read permission to get a list of valid credentials IDs, bypassing intended access controls (Jenkins Advisory).

The vulnerability allows unauthorized users with Overall/Read permission to enumerate valid credential IDs in the system. These credential IDs can potentially be used as part of an attack to capture the actual credentials when combined with other vulnerabilities (Jenkins Advisory).

The vulnerability was fixed in Pipeline GitHub Notify Step Plugin version 1.0.5, which requires the permission to configure a project before allowing enumeration of credentials IDs. Users should upgrade to this version or later to address the vulnerability (Jenkins Advisory).