CVE-2019-1003069: Aqua Security Scanner Plugin stores credentials in plain text
Summary
CVE-2019-1003069: Jenkins Aqua Security Scanner Plugin stores credentials in plain text. Affects org.jenkins-ci.plugins:aqua-security-scanner versions < 3.0.16. Fixed in 3.0.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Aqua Security Scanner Plugin is a plugin for Jenkins, an open-source automation server. It is designed to scan Docker images for security vulnerabilities and compliance issues. The plugin integrates with Aqua Security's platform to provide comprehensive scanning capabilities. However, a vulnerability has been discovered in the plugin that exposes credentials stored in plain text in its global configuration file on the Jenkins controller.
Vulnerability Detail
The Aqua Security Scanner Plugin stores credentials unencrypted in the file org.jenkinsci.plugins.aquadockerscannerbuildstep.AquaDockerScannerBuilder.xml on the Jenkins controller. This means that any user with access to the Jenkins controller file system can view these credentials. This vulnerability poses a risk as it allows unauthorized users to obtain sensitive information, such as usernames and passwords, potentially leading to unauthorized access or other malicious activities.
How To Fix
Minimum fixed version
3.0.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the Aqua Security Scanner Plugin to address the issue.
Conclusion
The Aqua Security Scanner Plugin vulnerability allows credentials to be stored in plain text, potentially exposing sensitive information to unauthorized users. It is crucial to update to the fixed version of the plugin and secure the global configuration file to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:aqua-security-scanner →
FAQ
This vulnerability allows unauthorized users to view credentials stored in plain text, potentially leading to unauthorized access or other malicious activities.
Users of the Aqua Security Scanner Plugin versions 3.0.15 and below are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, the vulnerability has been fixed in version 3.0.16 of the Aqua Security Scanner Plugin.
To protect your Jenkins installation, it is recommended to update the Aqua Security Scanner Plugin to version 3.0.16 or later and ensure that the global configuration file org.jenkinsci.plugins.aquadockerscannerbuildstep.AquaDockerScannerBuilder.xml is properly secured.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:aqua-security-scanner.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
