PT-2020-15372 · Jenkins · Jenkins Openshift Deployer Plugin+1

James Holderness · Published 2020-03-09 · Updated 2023-10-25 · CVE-2020-2155

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins OpenShift Deployer Plugin versions 1.2.0 and earlier

Description The issue is related to the transmission of configured credentials in plain text as part of the global Jenkins configuration form. This potentially results in their exposure. The credentials are stored encrypted on disk in the org.jenkinsci.plugins.openshift.DeployApplication.xml file on the Jenkins controller but are transmitted in plain text as part of the configuration form. This can lead to exposure through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Recommendations For Jenkins OpenShift Deployer Plugin versions 1.2.0 and earlier, consider disabling the transmission of credentials in plain text as a temporary workaround until a patch is available. Restrict access to the global Jenkins configuration form to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-2155

GHSA-2RRX-Q65F-8945

Affected Products

Jenkins

Jenkins Openshift Deployer Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2020-2155 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rrx-q65f-8945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2155 · Security Note
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1518 · Vendor Advisory
• https://github.com/jenkinsci/openshift-deployer-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note
• https://t.me/cvenotify/1413 · Telegram Post