PT-2019-11809 · Jenkins · Jenkins Violation Comments To Gitlab Plugin+1

James Holderness · Published 2019-09-25 · Updated 2023-10-25 · CVE-2019-10415

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner. Specifically, the plugin stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

Recommendations For Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier, update the plugin to a version that stores credentials encrypted. Additionally, for existing jobs, save their configuration to overwrite existing plain text credentials with encrypted ones.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-10415

GHSA-8HWR-589G-XPJ2

Affected Products

Jenkins

Jenkins Violation Comments To Gitlab Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10415 · Security Note
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1577 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10415 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8hwr-589g-xpj2 · Vendor Advisory
• https://github.com/jenkinsci/violation-comments-to-gitlab-plugin/commit/e8237a803012bae7773d8bd10fe02e21892be3fe · Note
• http://openwall.com/lists/oss-security/2019/09/25/3 · Note