PT-2020-15459 · Jenkins · Jenkins Parameterized Trigger Plugin+1

Wasin Saengow · Published 2020-09-01 · Updated 2023-10-25 · CVE-2020-2239

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Parameterized Remote Trigger Plugin versions 3.1.3 and earlier

Description The issue concerns the storage of a secret in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the secret is stored in the org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml file. This allows attackers with access to the Jenkins controller file system to view the secret.

Recommendations For Jenkins Parameterized Remote Trigger Plugin versions 3.1.3 and earlier, update to version 3.1.4 or later to ensure the secret is stored encrypted after re-saving the configuration. As a temporary workaround, consider restricting access to the Jenkins controller file system to minimize the risk of exploitation.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-256

CWE-311

Related Identifiers

CVE-2020-2239

GHSA-WPHQ-J78P-FHGP

Affected Products

Jenkins

Jenkins Parameterized Trigger Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2020-2239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2239 · Security Note
• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1625 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wphq-j78p-fhgp · Vendor Advisory
• https://github.com/jenkinsci/parameterized-remote-trigger-plugin · Note
• https://github.com/jenkinsci/parameterized-remote-trigger-plugin/commit/2902ef5ea6eb077f43fd25c880e4920faea4e828 · Note
• http://openwall.com/lists/oss-security/2020/09/01/3 · Note