PT-2020-15331 · Jenkins · Jenkins Dynamic Extended Choice Parameter Plugin+1

James Holderness · Published 2020-02-12 · Updated 2023-10-25 · CVE-2020-2124

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Dynamic Extended Choice Parameter Plugin versions 1.0.1 and earlier

Description The issue concerns the storage of passwords in an unencrypted manner in job config.xml files on the Jenkins master. This allows users with Extended Read permission or access to the master file system to view the passwords.

Recommendations For Jenkins Dynamic Extended Choice Parameter Plugin versions 1.0.1 and earlier, update to a version that properly encrypts passwords to prevent unauthorized access.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-2124

GHSA-H6PP-V4J6-W76C

Affected Products

Jenkins

Jenkins Dynamic Extended Choice Parameter Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2124 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2124 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1560 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h6pp-v4j6-w76c · Vendor Advisory
• https://github.com/jenkinsci/dynamic-extended-choice-parameter-plugin · Note
• https://t.me/cvenotify/923 · Telegram Post
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note