PT-2020-15394 · Jenkins · Jenkins Credentials Binding Plugin+1

Published 2020-05-06 · Updated 2023-10-25 · CVE-2020-2181

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Credentials Binding Plugin versions 1.22 and earlier

Description The issue concerns the Jenkins Credentials Binding Plugin, where secrets are not masked in the build log when the build contains no build steps. This affects the security of sensitive information.

Recommendations For Jenkins Credentials Binding Plugin versions 1.22 and earlier, update to version 1.23 or later to ensure secrets are masked in the build log when the build contains no build steps.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-2181

GHSA-43J2-R4V3-M8JP

RHSA-2020:3453

RHSA-2020:3625

RHSA-2020:4265

Affected Products

Jenkins

Jenkins Credentials Binding Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2020-2181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2181 · Security Note
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43j2-r4v3-m8jp · Vendor Advisory
• https://github.com/jenkinsci/credentials-binding-plugin · Note
• https://github.com/jenkinsci/credentials-binding-plugin/commit/59ead11bcb3fd132258d1d7da4a34d47750f40d2 · Note
• http://openwall.com/lists/oss-security/2020/05/06/3 · Note