CVE-2019-10320: Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin
Summary
CVE-2019-10320: Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certific... Affects org.jenkins-ci.plugins:credentials versions < 2.1.19. Fixed in 2.1.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Credentials Plugin is a component of the Jenkins automation server that allows users to securely store and manage credentials such as usernames, passwords, and certificates. It provides a centralized repository for these sensitive information, ensuring they are securely accessed by Jenkins jobs and plugins. However, versions 2.1.18 and earlier of the plugin are vulnerable to an attack that allows users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path and obtain the certificate content of files containing a PKCS#12 certificate.
Vulnerability Detail
The vulnerability (CVE-2019-10320) in the Jenkins Credentials Plugin allows an attacker with appropriate permissions to manipulate file paths and access the content of files containing PKCS#12 certificates. By exploiting this vulnerability, an attacker could potentially gain unauthorized access to sensitive information, including private keys and certificates. This could lead to further compromise of the Jenkins server and the systems it interacts with. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.1.19
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the Jenkins Credentials Plugin is not immediately feasible, a temporary workaround is to restrict access to the plugin and its functionality to trusted users only. This can be achieved by adjusting the permissions and roles within the Jenkins server to limit the ability to create or update credentials. Additionally, it is recommended to regularly monitor the Jenkins server for any unauthorized access or suspicious activity.
Conclusion
The Jenkins Credentials Plugin versions 2.1.18 and earlier are vulnerable to an attack that allows unauthorized access to sensitive information. It is crucial to upgrade the plugin to version 2.1.19 or later to mitigate this vulnerability. Restricting access to the plugin and monitoring for any suspicious activity are recommended as temporary workarounds. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:credentials →
FAQ
The vulnerability allows an attacker to access sensitive information, such as private keys and certificates, stored in the Jenkins Credentials Plugin. This could lead to unauthorized access to systems and potential compromise of the Jenkins server.
Users of Jenkins versions 2.1.18 and earlier with the Credentials Plugin installed are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix or workaround to mitigate the risk.
No, this vulnerability requires an authenticated user with permission to create or update credentials in the Jenkins server.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:credentials.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
