PT-2018-9463 · Jenkins · Jenkins Z/Os Connector Plugin+2

Viktor Gazdag · Published 2018-06-26 · Updated 2022-05-13 · CVE-2018-1000608

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins z/OS Connector Plugin versions 1.2.6.1 and earlier

Description A sensitive information exposure issue exists, allowing an attacker with local file system access or control of a Jenkins administrator's web browser to retrieve the configured password. This is possible due to the vulnerability in the SCLMSCM.java file. It is noted that IBM z/OS Connector Plugin version 2.0.0 and newer integrates with Credentials Plugin and no longer stores credentials itself.

Recommendations For Jenkins z/OS Connector Plugin versions 1.2.6.1 and earlier, consider updating to version 2.0.0 or newer, which integrates with the Credentials Plugin and no longer stores credentials itself, mitigating the risk of sensitive information exposure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-1000608

GHSA-5FQ9-X9F4-X2R2

Affected Products

Credentials Plugin

Jenkins

Jenkins Z/Os Connector Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000608 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000608 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-06-25/#SECURITY-950 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5fq9-x9f4-x2r2 · Vendor Advisory
• https://github.com/jenkinsci/zos-connector-plugin · Note