PT-2020-15553 · Cloudbees+2 · Jenkins+1

Long Nguyen · Published 2020-11-04 · Updated 2023-10-25 · CVE-2020-2319

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins VMware Lab Manager Slaves Plugin versions 0.2.8 and earlier

Description The issue concerns the storage of a password in an unencrypted form in the global config.xml file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the password. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. Technical details include the storage of the password in the config.xml file, which can be accessed by users with file system access to the Jenkins controller.

Recommendations For Jenkins VMware Lab Manager Slaves Plugin versions 0.2.8 and earlier, consider updating to a version that properly encrypts passwords, if available. As a temporary workaround, restrict access to the Jenkins controller file system to minimize the risk of password exposure. Avoid storing sensitive information in the global config.xml file until the issue is resolved.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-2319

GHSA-CG4H-CFJP-H3X2

Affected Products

Jenkins

Jenkins Vmware Lab Manager Slaves Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2319 · Security Note
• https://jenkins.io/security/advisory/2020-11-04/#SECURITY-2084 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2319 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg4h-cfjp-h3x2 · Vendor Advisory
• https://github.com/jenkinsci/labmanager-plugin · Note
• https://t.me/cvenotify/5102 · Telegram Post
• https://t.me/cvenotify/5147 · Telegram Post