A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials.

Database Plugin 1.7 requires Overall/Administer permission for the affected form validation method.

Affected Packages

Maven org.jenkins-ci.plugins:database

Affected versions: 0 (fixed in 1.7)

Related CVEs

CVE-2020-2242

Key Information

GHSA ID

GHSA-hj36-v72x-cc6j

Published

May 24, 2022 5:27 PM

Last Modified

December 20, 2022 10:37 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:database

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.