PT-2020-15334 · Jenkins · Jenkins Digitalocean Plugin+1

James Holderness · Published 2020-02-12 · Updated 2023-10-25 · CVE-2020-2126

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins DigitalOcean Plugin version 1.1 and earlier

Description The issue concerns the storage of a token in an unencrypted form within the global config.xml file on the Jenkins master. This token can be accessed by users who have permission to view the master file system.

Recommendations For Jenkins DigitalOcean Plugin version 1.1 and earlier, consider restricting access to the global config.xml file to minimize the risk of token exposure until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-2126

GHSA-8G6V-G8QC-5W7J

Affected Products

Jenkins

Jenkins Digitalocean Plugin

References · 8

• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2126 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2126 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8g6v-g8qc-5w7j · Vendor Advisory
• https://github.com/jenkinsci/digitalocean-plugin · Note
• https://github.com/jenkinsci/digitalocean-plugin/commit/ca1112c5c52a842c6340401f02f536fc07c6620a · Note
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note
• https://t.me/cvenotify/925 · Telegram Post