CVE-2018-1999031: Jenkins meliora-testlab Plugin API Key Exposure
Summary
CVE-2018-1999031: An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API k... Affects org.jenkins-ci.plugins:meliora-testlab versions < 1.15. Fixed in 1.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins meliora-testlab Plugin is a Maven package that integrates with the Jenkins CI/CD platform. It provides functionality for interacting with the Testlab tool. The plugin allows users to configure and manage Testlab integration within their Jenkins pipelines. However, versions 1.14 and earlier of the plugin are vulnerable to an exposure of sensitive information issue.
Vulnerability Detail
The vulnerability in the Jenkins meliora-testlab Plugin (versions 1.14 and earlier) resides in the TestlabNotifier.java file. Attackers with file system access to the Jenkins master can exploit this vulnerability to obtain the API key stored in the plugin's configuration. The API key is not masked from view, making it easily accessible to unauthorized individuals. This can lead to potential misuse of the API key and unauthorized access to Testlab resources. The issue has been addressed in version 1.15, where the API key is now stored encrypted in the configuration files and is no longer displayed in plain text.
How To Fix
Minimum fixed version
1.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The Jenkins meliora-testlab Plugin (versions 1.14 and earlier) is vulnerable to an API key exposure issue, allowing attackers with file system access to obtain the key. Upgrading to version 1.15 or later is recommended to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:meliora-testlab →
FAQ
The vulnerability allows attackers with file system access to obtain the API key stored in the Jenkins meliora-testlab Plugin's configuration. This can lead to unauthorized access to Testlab resources and potential misuse of the API key.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file for analysis.
Yes, the CVSS score for this vulnerability is 3.3.
Yes, the vulnerability has been reviewed by GitHub and the fix has been implemented in version 1.15 of the Jenkins meliora-testlab Plugin.
Yes, versions 1.14 and earlier of the Jenkins meliora-testlab Plugin are known to be affected by this vulnerability.
