PT-2019-11720 · Jenkins · Jenkins Azure Ad Plugin+1

Mark Combellack · Publicado 2019-04-30 · Atualizado 2023-10-25 · CVE-2019-10318

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Azure AD Plugin versions 0.3.3 and earlier

Description The issue concerns the storage of the client secret in the global config.xml configuration file on the Jenkins master or controller. This secret was stored unencrypted, allowing users with access to the master or controller file system to view the credentials.

Recommendations For Jenkins Azure AD Plugin versions 0.3.3 and earlier, update the plugin to a version that stores the client secret encrypted, as the updated Azure AD Plugin now includes this security enhancement.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2019-10318

GHSA-JCWJ-J574-8J2C

Produtos afetados

Jenkins

Jenkins Azure Ad Plugin

Referências · 8

• https://github.com/jenkinsci/azure-ad-plugin/commit/70983d1a6528847ccd6e7f124450c578c42d194f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10318 · Nota de Segurança
• http://openwall.com/lists/oss-security/2019/04/30/5 · Nota
• https://osv.dev/vulnerability/CVE-2019-10318 · Aviso do Fabricante
• https://web.archive.org/web/20200227073756/http://securityfocus.com/bid/108159 · Nota
• http://securityfocus.com/bid/108159 · Nota
• https://osv.dev/vulnerability/GHSA-jcwj-j574-8j2c · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390 · Aviso do Fabricante