CVE-2020-2196: 
Java vulnerability analysis and mitigation

Jenkins Selenium Plugin version 3.141.59 and earlier contains a critical security vulnerability (CVE-2020-2196) identified in June 2020. The vulnerability stems from a complete lack of CSRF (Cross-Site Request Forgery) protection for its HTTP endpoints, which affects the plugin's administrative functionality (Jenkins Advisory).

The vulnerability is characterized by the absence of CSRF protection mechanisms on HTTP endpoints in the Selenium Plugin. This security flaw has been assigned a High severity rating with a CVSS v3.1 Base Score of 8.0 (HIGH) with the vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The vulnerability is tracked as SECURITY-1766 in Jenkins' security tracking system (NVD).

The vulnerability allows attackers to perform several critical administrative actions: restart the Selenium Grid hub, delete or replace the plugin configuration, and start, stop, or restart Selenium configurations on specific nodes. Most critically, through carefully chosen configuration parameters, these actions can result in OS command injection on the Jenkins controller (Jenkins Advisory).

The vulnerability is remotely exploitable and requires low attack complexity. While it requires low privileges and user interaction, the potential for OS command injection makes it particularly dangerous. The vulnerability affects all versions of the Selenium Plugin up to and including version 3.141.59 (NVD).

As of the initial advisory publication on June 3, 2020, no official fix was available for this vulnerability (Jenkins Advisory). Given the severity of the vulnerability, users should consider implementing additional security controls or limiting access to the affected endpoints until a patch becomes available.