PT-2018-5169 · Jenkins · Jenkins Build-Publisher Plugin+1

Steve Marlowe · Publicado 2018-01-26 · Atualizado 2022-05-13 · CVE-2017-1000387

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Build-Publisher plugin versions 1.21 and earlier

Description The Jenkins Build-Publisher plugin stores credentials to other Jenkins instances in the file hudson.plugins.build publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials are stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials are transmitted in plain text as part of the configuration form, which could result in exposure through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Recommendations For Jenkins Build-Publisher plugin versions 1.21 and earlier, update to version 1.22 or later, which encrypts the credentials on disk and only transmits their encrypted form to users viewing the configuration form.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2017-1000387

GHSA-M3WV-FR8V-FMH7

Produtos afetados

Jenkins

Jenkins Build-Publisher Plugin

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000387 · Nota de Segurança
• https://jenkins.io/security/advisory/2017-10-23 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000387 · Aviso do Fabricante
• http://securityfocus.com/bid/101544 · Nota
• https://osv.dev/vulnerability/GHSA-m3wv-fr8v-fmh7 · Aviso do Fabricante