PT-2019-11810 · Jenkins · Jenkins Violation Comments To Gitlab Plugin+1

James Holderness · Published 2019-09-25 · Updated 2023-10-25 · CVE-2019-10416

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner. Specifically, the Violation Comments to GitLab Plugin stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Recommendations For Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier, save the job configuration to overwrite existing plain text credentials with encrypted ones, as the plugin now stores credentials encrypted.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-10416

GHSA-3P8R-P4Q5-MC44

Affected Products

Jenkins

Jenkins Violation Comments To Gitlab Plugin

References · 6

• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1577 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10416 · Security Note
• https://osv.dev/vulnerability/GHSA-3p8r-p4q5-mc44 · Vendor Advisory
• https://github.com/jenkinsci/violation-comments-to-gitlab-plugin/commit/e8237a803012bae7773d8bd10fe02e21892be3fe · Note
• http://openwall.com/lists/oss-security/2019/09/25/3 · Note