CVE-2019-10412: Jenkins Inedo ProGet Plugin Plugin Cleartext Transmission of Sensitive Information
Summary
CVE-2019-10412: Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information. Affects com.inedo.proget:inedo-proget versions < 1.3. Fixed in 1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Inedo ProGet Plugin Plugin is a Maven package management tool used in Jenkins. It allows users to store and manage packages in a centralized repository. The plugin provides features such as package versioning, dependency management, and access control. However, a vulnerability has been identified in the plugin that involves the cleartext transmission of sensitive information.
Vulnerability Detail
The Inedo ProGet Plugin Plugin stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could potentially expose the password to various security risks, such as browser extensions, cross-site scripting vulnerabilities, and similar situations. The vulnerability has a CVSS score of 3.1, indicating a low severity level. The issue has been addressed in version 1.3 of the plugin, which now encrypts the password transmitted to administrators viewing the global configuration form.
How To Fix
Minimum fixed version
1.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Inedo ProGet Plugin Plugin in Jenkins is vulnerable to cleartext transmission of sensitive information. This could potentially expose the service password stored in the plugin's global configuration. To mitigate the risk, users should update to version 1.3 or later, which encrypts the password during transmission. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.inedo.proget:inedo-proget →
FAQ
The vulnerability could potentially expose the service password stored in the Inedo ProGet Plugin Plugin's global Jenkins configuration. This could lead to unauthorized access to the repository and compromise the security of the package management system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are detected.
At the moment, there are no known workarounds for this vulnerability. It is recommended to update the Inedo ProGet Plugin Plugin to the latest version to mitigate the risk.
There is no evidence of this vulnerability being actively exploited in the wild. However, it is still important to address the issue promptly to ensure the security of your Jenkins instance.
This vulnerability was discovered and reported by the GitHub Security Lab. They have worked with the plugin maintainers to address the issue and release a fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.inedo.proget:inedo-proget.
