CVE-2020-2142: 
Java vulnerability analysis and mitigation

A missing permission check vulnerability (CVE-2020-2142) was discovered in Jenkins P4 Plugin versions 1.10.10 and earlier. The vulnerability was disclosed on March 9, 2020, affecting the Jenkins P4 Plugin which is used for Perforce repository integration (Jenkins Advisory, OSS Security).

The vulnerability stems from the P4 Plugin's failure to perform proper permission checks in several HTTP endpoints. This security flaw allows users with only Overall/Read access to trigger builds or add labels in the Perforce repository. The vulnerability has a CVSS severity rating of Medium (Jenkins Advisory).

The vulnerability enables users with basic Overall/Read access to perform unauthorized actions such as triggering builds and adding labels in the Perforce repository, potentially compromising the build process integrity (Jenkins Advisory).

The vulnerability was fixed in P4 Plugin version 1.10.11, which implements proper permission checks for the affected HTTP endpoints. Users are advised to upgrade to this version or later. The fix requires POST requests and appropriate user permissions for the affected HTTP endpoints (Jenkins Advisory).