PT-2020-15527 · Jenkins · Jenkins Sms Notification Plugin+1

Long Nguyen · Published 2020-10-08 · Updated 2023-10-25 · CVE-2020-2297

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SMS Notification Plugin versions 1.2 and earlier

Description The issue concerns the storage of an access token in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the file com.hoiio.jenkins.plugin.SMSNotification.xml contains this unencrypted access token as part of its configuration. Users with access to the Jenkins controller file system can view this access token.

Recommendations For Jenkins SMS Notification Plugin versions 1.2 and earlier, consider restricting access to the Jenkins controller file system to minimize the risk of the access token being viewed by unauthorized users. As a temporary workaround, restrict access to the com.hoiio.jenkins.plugin.SMSNotification.xml file until a more secure method of storing the access token is implemented.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-2297

GHSA-VWFV-QPW8-83C7

Affected Products

Jenkins

Jenkins Sms Notification Plugin

References · 6

• https://jenkins.io/security/advisory/2020-10-08/#SECURITY-2054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2297 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2297 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vwfv-qpw8-83c7 · Vendor Advisory
• https://github.com/jenkinsci/sms-plugin · Note
• http://openwall.com/lists/oss-security/2020/10/08/5 · Note