CVE-2020-2323: 
Java vulnerability analysis and mitigation

Jenkins Chaos Monkey Plugin 0.4 and earlier contains a security vulnerability (CVE-2020-2323) identified in December 2020. The vulnerability stems from missing permission checks in an HTTP endpoint, which affects the access control mechanisms of the plugin (Jenkins Advisory, OSS Security).

The vulnerability is classified as Medium severity with a CVSS v3.1 base score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The core issue lies in the plugin's failure to implement proper permission checks for an HTTP endpoint that provides access to the Chaos Monkey page and action history (NVD).

The vulnerability allows attackers with Overall/Read permission to access the Chaos Monkey page and view the history of actions, potentially exposing sensitive operational information about the Jenkins instance (Jenkins Advisory).

The vulnerability can be exploited by any user with Overall/Read permission in the Jenkins instance. No special conditions or complex attack vectors are required to exploit this vulnerability (Jenkins Advisory).

The vulnerability has been fixed in Chaos Monkey Plugin version 0.4.1, which implements proper permission checks requiring Overall/Administer permission to access the Chaos Monkey page and view the history of actions. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).