PT-2020-15521 · Jenkins · Couchdb-Statistics Plugin+1

Long Nguyen · Published 2020-10-08 · Updated 2023-10-25 · CVE-2020-2291

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins couchdb-statistics Plugin versions 0.3 and earlier

Description The issue concerns the storage of the server password in an unencrypted form in the global configuration file on the Jenkins controller. Specifically, the password is stored in the org.jenkinsci.plugins.couchstats.CouchStatsConfig.xml file. This allows users with access to the Jenkins controller file system to view the password.

Recommendations For Jenkins couchdb-statistics Plugin versions 0.3 and earlier, update the plugin to version 0.4 or later and re-save the configuration to encrypt the server password. As a temporary workaround, consider restricting access to the Jenkins controller file system to minimize the risk of password exposure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-2291

GHSA-JRJR-7RF4-3WQH

Affected Products

Jenkins

Couchdb-Statistics Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-2291 · Security Note
• https://osv.dev/vulnerability/GHSA-jrjr-7rf4-3wqh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2291 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-10-08/#SECURITY-2065 · Vendor Advisory
• https://github.com/jenkinsci/couchdb-statistics-plugin · Note
• http://openwall.com/lists/oss-security/2020/10/08/5 · Note