CVE-2020-2094

Name of the Vulnerable Software and Affected Versions Jenkins Health Advisor by CloudBees Plugin versions 3.0 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient. The form validation methods do not perform permission checks and do not require POST requests, resulting in a CSRF vulnerability.

Recommendations For Jenkins Health Advisor by CloudBees Plugin versions 3.0 and earlier, consider updating to version 3.0.1 or later, which requires POST requests and Overall/Administer permission for the affected form validation methods. As a temporary workaround, consider restricting access to the form validation methods to minimize the risk of exploitation.