PT-2020-15314 · Jenkins · Jenkins Fortify Plugin+1

James Holderness · Published 2020-01-29 · Updated 2023-10-25 · CVE-2020-2107

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Fortify Plugin versions 19.1.29 and earlier

Description The issue concerns the storage of proxy server passwords in an unencrypted manner within job config.xml files on the Jenkins master. These passwords can be accessed by users who have Extended Read permission or direct access to the master file system. The problem allows unauthorized viewing of sensitive information.

Recommendations For Jenkins Fortify Plugin versions 19.1.29 and earlier, update to version 19.2.30 or later, which encrypts the proxy server password, to resolve the issue. As a temporary workaround, consider restricting access to the master file system and limiting Extended Read permissions to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-2107

GHSA-XR37-PJFH-QWWC

Affected Products

Jenkins

Jenkins Fortify Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2020-2107 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xr37-pjfh-qwwc · Vendor Advisory
• https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2107 · Security Note
• https://github.com/jenkinsci/fortify-plugin · Note
• http://openwall.com/lists/oss-security/2020/01/29/1 · Note
• https://t.me/cvenotify/602 · Telegram Post