CVE-2020-2192: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins Self-Organizing Swarm Plug-in Modules Plugin versions 3.20 and earlier. The vulnerability was disclosed on June 3, 2020, affecting the plugin's API endpoints that handle agent label management (Jenkins Advisory, NVD).

The vulnerability exists in the API endpoints used to add or remove agent labels. These endpoints did not require POST requests, making them susceptible to CSRF attacks. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) (NVD).

The vulnerability allows attackers to add or remove agent labels through cross-site request forgery attacks. This could potentially lead to unauthorized modification of agent configurations, affecting the Jenkins build infrastructure (Jenkins Advisory).

The vulnerability can be exploited remotely without authentication, requiring only user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

The vulnerability has been fixed in Swarm Plugin version 3.21. The fix implements proper POST request requirements and Agent/Configure permission checks for the affected endpoints. The update also removes the use of global Swarm secret for these API endpoints (Jenkins Advisory).

The vulnerability was discovered and reported by Oleg Nenashev of CloudBees, Inc. The Jenkins project acknowledged the discovery in their security advisory (Jenkins Advisory).