Amazon EC2 Plugin 1.50.1 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows an attacker to provision instances with an attacker-specified template ID.

Amazon EC2 Plugin 1.50.2 now requires POST requests for the affected HTTP endpoints.

Affected Packages

Maven org.jenkins-ci.plugins:ec2

Affected versions: 0 (fixed in 1.50.2)

Related CVEs

CVE-2020-2186

Key Information

GHSA ID

GHSA-w6hw-57jq-h7f5

Published

May 24, 2022 5:17 PM

Last Modified

December 16, 2022 10:55 PM

CVSS Score

2.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:ec2

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.