PT-2018-9283 · Jenkins · Jenkins Coverity Plugin+1

Steve Marlowe · Published 2018-03-13 · Updated 2022-05-13 · CVE-2018-1000104

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Coverity Plugin versions 1.10.0 and earlier

Description: A plaintext storage of a password issue exists in CIMInstance.java, allowing an attacker with local file system access or control of a Jenkins administrator's web browser to retrieve the configured keystore and private key passwords.

Recommendations: For Jenkins Coverity Plugin versions 1.10.0 and earlier, update to version 1.11.0, which integrates with Credentials Plugin to securely store passwords and automatically migrates existing passwords.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-1000104

GHSA-CGHG-JCV6-4V5M

Affected Products

Jenkins

Jenkins Coverity Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2018-1000104 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-02-26/#SECURITY-260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000104 · Security Note
• https://osv.dev/vulnerability/GHSA-cghg-jcv6-4v5m · Vendor Advisory
• https://github.com/jenkinsci/coverity-plugin/commit/34b7c2b07014b8e1e708361170146600db172491 · Note
• https://github.com/jenkinsci/coverity-plugin · Note