PT-2020-15473 · Jenkins · Jenkins Team Foundation Server Plugin+1

James Holderness · Published 2020-09-01 · Updated 2023-10-25 · CVE-2020-2249

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier

Description The issue concerns the storage of a webhook secret in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the secret is stored in the hudson.plugins.tfs.TeamPluginGlobalConfig.xml file. This allows attackers with access to the Jenkins controller file system to view the secret.

Recommendations For Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier, consider restricting access to the Jenkins controller file system to minimize the risk of exploitation. As a temporary workaround, restrict access to the hudson.plugins.tfs.TeamPluginGlobalConfig.xml file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-256

CWE-311

Related Identifiers

CVE-2020-2249

GHSA-W6C2-JRHH-JRXG

Affected Products

Jenkins

Jenkins Team Foundation Server Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2020-2249 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6c2-jrhh-jrxg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2249 · Security Note
• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506 · Vendor Advisory
• https://github.com/jenkinsci/tfs-plugin · Note
• http://openwall.com/lists/oss-security/2020/09/01/3 · Note