PT-2020-15428 · Jenkins · Jenkins White Source Plugin+1

Wasin Saengow · Published 2020-07-02 · Updated 2023-10-25 · CVE-2020-2213

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins White Source Plugin versions 19.1.1 and earlier Jenkins White Source Plugin versions prior to 20.8.1

Description The issue allows credentials to be stored unencrypted in the global configuration file and in job config.xml files on the Jenkins master. These credentials can be viewed by users with Extended Read permission or access to the master file system. The credentials are stored in plain text as part of the global configuration file org.whitesource.jenkins.pipeline.WhiteSourcePipelineStep.xml and job config.xml files on the Jenkins controller.

Recommendations For versions 19.1.1 and earlier, update to version 20.8.1 or later to resolve the issue. For versions prior to 20.8.1, update to version 20.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Jenkins controller file system and limiting Extended Read permission to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-2213

GHSA-V8V2-FHGV-3VQ2

Affected Products

Jenkins

Jenkins White Source Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2020-2213 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2213 · Security Note
• https://osv.dev/vulnerability/GHSA-v8v2-fhgv-3vq2 · Vendor Advisory
• https://github.com/jenkinsci/whitesource-plugin/commit/4a9ee37246848c65cd41c5cf17d84992ffc6d21d · Note
• https://github.com/jenkinsci/whitesource-plugin · Note
• http://openwall.com/lists/oss-security/2020/07/02/7 · Note
• https://t.me/cvenotify/4820 · Telegram Post