CVE-2020-2191: 
Java vulnerability analysis and mitigation

Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier contains a security vulnerability identified as CVE-2020-2191. The vulnerability was discovered in the plugin's API endpoints that handle agent label management. This issue was disclosed on June 3, 2020, affecting all versions up to and including 3.20 of the Swarm Plugin (Jenkins Advisory, OSS Security).

The vulnerability stems from improper permission checks on API endpoints that allow adding and removing agent labels. The issue received a CVSS v3.1 Base Score of 4.3 (MEDIUM), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability allows users with Agent/Create permission to modify labels of any agent without proper authorization checks, only requiring a global Swarm secret (Jenkins Advisory).

The vulnerability allows unauthorized users with Agent/Create permission to add or remove labels of any agent in the system, potentially affecting job scheduling and resource allocation within Jenkins. This could lead to jobs being executed on unintended agents, compromising the build environment's integrity (Jenkins Advisory).

The vulnerability can be exploited by users who have Agent/Create permission in the Jenkins environment. The attack requires network access to the Jenkins instance and knowledge of the global Swarm secret (Jenkins Advisory).

The vulnerability was fixed in Swarm Plugin version 3.21. The update implements proper permission checks requiring Agent/Configure permission for the affected agent endpoints and removes the use of global Swarm secret for these API endpoints. Users are advised to upgrade to version 3.21 or later (Jenkins Advisory).