PT-2020-15412 · Jenkins · Jenkins Project Inheritance Plugin+1

Daniel Beck + 1 · Published 2020-06-03 · Updated 2023-10-25 · CVE-2020-2198

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Project Inheritance Plugin versions 21.04.03 and earlier

Description The issue concerns the transmission of job config.xml data to users without proper Job/Configure permissions. Specifically, it does not redact encrypted secrets in the "getConfigAsXML" API endpoint when sending this data. This could potentially expose sensitive information.

Recommendations For Jenkins Project Inheritance Plugin versions 21.04.03 and earlier, consider restricting access to the "getConfigAsXML" API endpoint until a fix is available. As a temporary workaround, limit the transmission of job config.xml data to only those users with the necessary Job/Configure permissions.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-2198

GHSA-W53Q-R5CW-6VJH

Affected Products

Jenkins

Jenkins Project Inheritance Plugin

References · 5

• https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2198 · Security Note
• https://osv.dev/vulnerability/GHSA-w53q-r5cw-6vjh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2198 · Vendor Advisory
• http://openwall.com/lists/oss-security/2020/06/03/3 · Note