CVE-2018-1000608: Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password
Summary
CVE-2018-1000608: Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password. Affects org.jenkins-ci.plugins:zos-connector versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins z/OS Connector Plugin is a Maven package (org.jenkins-ci.plugins:zos-connector) that enables integration between Jenkins and IBM z/OS systems. It provides functionality for managing jobs and interacting with z/OS resources. The plugin version 1.2.6.1 and earlier includes a vulnerability that exposes sensitive information.
Vulnerability Detail
The vulnerability in the Jenkins z/OS Connector Plugin (version 1.2.6.1 and earlier) resides in the SCLMSCM.java file. It allows a local attacker with access to the file system or control over a Jenkins administrator's web browser (e.g., through a malicious extension) to retrieve the configured password. This can lead to unauthorized access to the z/OS system and potential compromise of sensitive data. The IBM z/OS Connector Plugin version 2.0.0 and newer addresses this vulnerability by integrating with the Credentials Plugin and no longer storing credentials itself.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the plugin to mitigate the risk.
Conclusion
The Jenkins z/OS Connector Plugin version 1.2.6.1 and earlier contains a vulnerability that allows a local attacker to retrieve the configured password. To mitigate this risk, it is crucial to upgrade to version 2.0.0 or later of the plugin. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:zos-connector →
FAQ
This vulnerability allows a local attacker to retrieve the configured password, potentially leading to unauthorized access to the z/OS system and exposure of sensitive data.
Users of Jenkins z/OS Connector Plugin versions 1.2.6.1 and earlier are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of the plugin.
To upgrade the plugin, update the Maven dependency in your project's pom.xml file to 'org.jenkins-ci.plugins:zos-connector:2.0.0' or a later version.
No, the fixed version of the plugin (2.0.0 and newer) integrates with the Credentials Plugin and no longer stores credentials itself.
