CVE-2020-2147: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability and missing permission checks were identified in Jenkins Mac Plugin version 1.1.0 and earlier. The vulnerability was discovered and disclosed on March 9, 2020, affecting the Jenkins automation server's Mac Plugin component (Jenkins Advisory, OSS Security).

The vulnerability stems from the Mac Plugin's failure to perform permission checks on a method implementing form validation. Additionally, the form validation method did not require POST requests. The issue was assigned a medium severity (CVSS) rating. The vulnerability is tracked as SECURITY-1761 with two CVE identifiers: CVE-2020-2147 for the CSRF aspect and CVE-2020-2148 for the missing permission check (Jenkins Advisory).

The vulnerability allows users with Overall/Read access to Jenkins to connect to an attacker-specified SSH host using attacker-specified credentials IDs obtained through another method, potentially leading to the capture of credentials stored in Jenkins (Jenkins Advisory).

The vulnerability was fixed in Mac Plugin version 1.2.0. The updated version implements proper permission checks requiring Overall/Administer permission and enforces POST requests for the affected form validation method (Jenkins Advisory).