PT-2014-3100 · Jenkins · Jenkins Subversion Plugin

Lennart Starr · Published 2014-05-08 · Updated 2023-02-13 · CVE-2013-6372

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jenkins Subversion plugin versions prior to 1.54

Description The issue allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file, due to the storage of credentials using base64 encoding.

Recommendations For versions prior to 1.54, update to version 1.54 or later to resolve the issue.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-255

Related Identifiers

CVE-2013-6372

GHSA-C4FR-GX5W-8QF2

Affected Products

Jenkins Subversion Plugin

References · 8

• 🔥 https://github.com/jenkinsci/subversion-plugin/commit/7d4562d6f7e40de04bbe29577b51c79f07d05ba6 · Exploit
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6372 · Security Note
• https://osv.dev/vulnerability/GHSA-c4fr-gx5w-8qf2 · Vendor Advisory
• https://github.com/jenkinsci/subversion-plugin · Note
• https://access.redhat.com/security/cve/CVE-2013-6372 · Note
• https://access.redhat.com/errata/RHBA-2014:1630 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1032391 · Note