GHSA-hx53-635r-vmv8

GitHub Security Advisory

Missing permission checks in Jenkins Chaos Monkey Plugin

✓ GitHub Reviewed MODERATE Has CVE

Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint.

This allows attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions.

Jenkins Chaos Monkey Plugin 0.4.1 requires Overall/Administer permission to access the Chaos Monkey page and to see the history of actions.

Maven io.jenkins.plugins:chaos-monkey

Affected versions: 0 (fixed in 0.4.1)

CVE-2020-2323

GHSA ID

GHSA-hx53-635r-vmv8

Published

May 24, 2022 5:35 PM

Last Modified

October 27, 2023 1:15 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

io.jenkins.plugins:chaos-monkey

GitHub Reviewed

✓ Yes

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.