SB2020021323 - Cleartext storage of sensitive information in Applatix plugin for Jenkins

Description

This security bulletin contains information about 1 vulnerability.

1) Cleartext storage of sensitive information (CVE-ID: CVE-2020-2133)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to view the password on the target system.

The vulnerability exists due to the affected software stores the Applatix password unencrypted in job "config.xml" files as part of its configuration. A remote user with Extended Read permission or access to the master file system can obtain credentials.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://www.openwall.com/lists/oss-security/2020/02/12/3
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1540