PT-2020-15361 · Jenkins · Jenkins Sonar Quality Gates Plugin+1

James Holderness · Published 2020-03-09 · Updated 2023-10-25 · CVE-2020-2150

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Sonar Quality Gates Plugin versions 1.3.1 and earlier

Description The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. The credentials are stored encrypted on disk in the org.quality.gates.jenkins.plugin.GlobalConfig.xml file on the Jenkins controller but are sent in plain text as part of the configuration form. This could lead to credential exposure through browser extensions, cross-site scripting vulnerabilities, or similar situations.

Recommendations For Jenkins Sonar Quality Gates Plugin versions 1.3.1 and earlier, consider updating to a version where this issue is resolved, as the current version transmits credentials in plain text. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-2150

GHSA-6FH3-XHWG-7HFH

Affected Products

Jenkins

Jenkins Sonar Quality Gates Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2150 · Security Note
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1523 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2150 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6fh3-xhwg-7hfh · Vendor Advisory
• https://github.com/jenkinsci/sonar-quality-gates-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note
• https://t.me/cvenotify/1409 · Telegram Post