CVE-2020-2197: 
Java vulnerability analysis and mitigation

Jenkins Project Inheritance Plugin 19.08.02 and earlier contains a permission check vulnerability (CVE-2020-2197) that was disclosed on June 3, 2020. The vulnerability affects the plugin's job inspection features, specifically the API URL /job/.../getConfigAsXML endpoint for Inheritance Project job type (Jenkins Advisory, OSS Security).

The vulnerability stems from a missing permission check in the Project Inheritance Plugin's API endpoint that provides access to job configuration XML data. The plugin fails to properly validate user permissions, allowing users with only Job/Read permission to access configuration data that should require Job/ExtendedRead permission, which is typically implied by Job/Configure permission (Jenkins Advisory). The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) (NVD).

The vulnerability allows unauthorized users with basic Job/Read permission to access sensitive job configuration XML data that should be restricted to users with higher privilege levels. This could potentially expose sensitive information stored in job configurations (Jenkins Advisory).

The vulnerability can be exploited by any authenticated user with Job/Read permission by accessing the /job/.../getConfigAsXML API endpoint. No special tools or complex exploitation techniques are required (Jenkins Advisory).

As of the advisory publication date on June 3, 2020, there was no fix available for this vulnerability in the Project Inheritance Plugin. Users should consider restricting access to the affected plugin functionality and carefully review user permissions until a patch becomes available (Jenkins Advisory).