CVE-2020-2273: 
Java vulnerability analysis and mitigation

CVE-2020-2273 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the Jenkins ElasTest Plugin version 1.2.1 and earlier, disclosed on September 16, 2020. The vulnerability affects the form validation functionality of the plugin (Jenkins Advisory).

The vulnerability stems from a form validation method that does not require POST requests in the ElasTest Plugin. This implementation flaw is tracked as SECURITY-1903 and has been assigned a Medium severity CVSS rating (Jenkins Advisory).

The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials through cross-site request forgery attacks (Jenkins Advisory).

The vulnerability can be exploited by attackers who have Overall/Read permission in the Jenkins instance. The form validation method's lack of POST request requirement makes it susceptible to CSRF attacks (Jenkins Advisory).

As of the advisory's publication date, no fix was available for this vulnerability in the ElasTest Plugin. Users should consider implementing additional security controls or limiting access to the plugin functionality until a patch becomes available (Jenkins Advisory).