CVE-2020-2235: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins Pipeline Maven Integration Plugin versions 3.8.2 and earlier. The vulnerability was identified with CVE-2020-2235 and was publicly disclosed on August 12, 2020. The affected component is the form validation method in the Pipeline Maven Integration Plugin (Jenkins Advisory, NVD).

The vulnerability stems from a form validation method that does not require POST requests. The CVSS v3.1 base score is 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (CSRF) (NVD).

This vulnerability allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially leading to the capture of credentials stored in Jenkins (Jenkins Advisory).

The vulnerability can be exploited by users with Overall/Read access to Jenkins. The attack requires the attacker to have previously obtained credentials IDs through another method (Jenkins Advisory).

The vulnerability was fixed in Pipeline Maven Integration Plugin version 3.8.3. The fix includes requiring POST requests and Job/Configure permission for the affected form validation method (Jenkins Advisory).

The vulnerability was discovered and reported by Tim Jacomb, and was addressed as part of a larger security advisory that included multiple Jenkins security fixes (OSS Security).