CVE-2020-2272: 
Java vulnerability analysis and mitigation

CVE-2020-2272 is a missing permission check vulnerability in Jenkins ElasTest Plugin versions 1.2.1 and earlier, discovered and disclosed on September 16, 2020. The vulnerability affects the form validation functionality in the ElasTest Plugin for Jenkins automation server (Jenkins Advisory, NVD).

The vulnerability stems from a missing permission check in a method implementing form validation. The CVSS v3.1 base score is 4.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is tracked under the weakness category CWE-862: Missing Authorization (NVD).

This vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, potentially leading to unauthorized access and information disclosure (Jenkins Advisory).

The vulnerability can be exploited by attackers who have Overall/Read permission in the Jenkins instance. The attack vector requires network access and low attack complexity (NVD).

As of the advisory publication date, there was no fix available for this vulnerability in the ElasTest Plugin. Users should consider restricting access to the Jenkins instance and limiting the assignment of Overall/Read permissions (Jenkins Advisory).