PT-2020-15360 · Jenkins · Jenkins Repository Connector Plugin+1

James Holderness · Published 2020-03-09 · Updated 2023-10-25 · CVE-2020-2149

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Repository Connector Plugin versions 1.2.6 and earlier

Description The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form. Although credentials are stored encrypted on disk in the org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml file on the Jenkins controller, they are sent in plain text when the configuration form is transmitted. This could lead to credential exposure through various means, including browser extensions and cross-site scripting vulnerabilities.

Recommendations For Jenkins Repository Connector Plugin versions 1.2.6 and earlier, consider updating to a version that addresses this issue, as the current version transmits credentials in plain text. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-2149

GHSA-4FJC-FWJ2-7XFG

Affected Products

Jenkins

Jenkins Repository Connector Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2149 · Security Note
• https://osv.dev/vulnerability/GHSA-4fjc-fwj2-7xfg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2149 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1520 · Vendor Advisory
• https://github.com/jenkinsci/repository-connector-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note
• https://t.me/cvenotify/1408 · Telegram Post