CVE-2019-10348: Jenkins Gogs Plugin stored credentials in plain text
Summary
CVE-2019-10348: Jenkins Gogs Plugin stored credentials in plain text. Affects org.jenkins-ci.plugins:gogs-webhook versions < 1.0.15. Fixed in 1.0.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Gogs Plugin is a Maven package that provides integration between Jenkins and the Gogs Git service. It allows users to configure webhooks in Jenkins to trigger builds based on events in Gogs. The plugin is commonly used in software development workflows to automate build and deployment processes.
Vulnerability Detail
The Jenkins Gogs Plugin had a vulnerability where it stored credentials in plain text in the job config.xml files on the Jenkins controller. This means that anyone with Extended Read permission or access to the Jenkins controller file system could view these credentials. This vulnerability could lead to unauthorized access to sensitive information, such as API keys or passwords, stored in the plugin's configuration.
How To Fix
Minimum fixed version
1.0.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have access to the Jenkins controller file system and by regularly monitoring and auditing access to the config.xml files.
Conclusion
The Jenkins Gogs Plugin had a vulnerability that allowed credentials to be stored in plain text, potentially exposing sensitive information. To fix this vulnerability, it is recommended to update to the latest version of the Gogs Plugin. Regular monitoring and access control to the config.xml files can also help mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:gogs-webhook →
FAQ
This vulnerability could allow unauthorized users to view sensitive credentials stored in the Jenkins Gogs Plugin configuration, potentially leading to unauthorized access to systems or services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity.
No, manual encryption of the credentials in the config.xml files is not recommended. It is best to update to the latest version of the Gogs Plugin, which includes the necessary encryption mechanisms.
There are no known exploits for this vulnerability at the time of this report. However, it is important to update to the latest version of the Gogs Plugin to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gogs-webhook.
