SB2020021315 - Cleartext storage of sensitive information in Dynamic Extended Choice Parameter plugin for Jenkins

Description

This security bulletin contains information about 1 vulnerability.

1) Cleartext storage of sensitive information (CVE-ID: CVE-2020-2124)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to view the password on the target system.

The vulnerability exists due to the affected software stores a Subversion password unencrypted in job "config.xml" files as part of its configuration. A remote user with Extended Read permission or access to the master file system can obtain credentials.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://www.openwall.com/lists/oss-security/2020/02/12/3
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1560