PT-2020-15340 · Jenkins · Jenkins Harvest Scm Plugin+1

James Holderness · CVE-2020-2131 · Published 2020-02-12 · Updated 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Harvest SCM Plugin versions 0.5.1 and earlier

Description The issue allows passwords to be stored unencrypted in job config.xml files on the Jenkins master. These passwords can be viewed by users with Extended Read permission or those who have access to the master file system.

Recommendations For Jenkins Harvest SCM Plugin versions 0.5.1 and earlier, update to a version later than 0.5.1 to ensure passwords are stored securely. As a temporary workaround, consider restricting access to the master file system and limiting Extended Read permissions to minimize the risk of password exposure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-2131

GHSA-QJ7P-9HGF-X8J7

Affected Products

Jenkins

Jenkins Harvest Scm Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2020-2131 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1553 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qj7p-9hgf-x8j7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2131 · Security Note
• https://github.com/jenkinsci/harvest-plugin · Note
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note
• https://t.me/cvenotify/930 · Telegram Post