PT-2018-5169 · Jenkins · Jenkins Build-Publisher Plugin+1

Steve Marlowe · Published 2018-01-26 · Updated 2022-05-13 · CVE-2017-1000387

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Build-Publisher plugin versions 1.21 and earlier

Description The Jenkins Build-Publisher plugin stores credentials to other Jenkins instances in the file hudson.plugins.build publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials are stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials are transmitted in plain text as part of the configuration form, which could result in exposure through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Recommendations For Jenkins Build-Publisher plugin versions 1.21 and earlier, update to version 1.22 or later, which encrypts the credentials on disk and only transmits their encrypted form to users viewing the configuration form.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2017-1000387

GHSA-M3WV-FR8V-FMH7

Affected Products

Jenkins

Jenkins Build-Publisher Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000387 · Security Note
• https://jenkins.io/security/advisory/2017-10-23 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000387 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m3wv-fr8v-fmh7 · Vendor Advisory
• http://securityfocus.com/bid/101544 · Note