CVE-2019-10413: Jenkins Data Theorem Mobile Security: CI/CD Plugin has Insufficiently Protected Credentials
Summary
CVE-2019-10413: Jenkins Data Theorem Mobile Security: CI/CD Plugin has Insufficiently Protected Credentials. Affects com.datatheorem.mobileappsecurity.jenkins.plugin:datatheorem-mobile-app-security versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Data Theorem Mobile Security: CI/CD Plugin is a Maven package that provides security features for mobile applications in the Jenkins continuous integration and continuous deployment (CI/CD) environment. It allows users to perform security testing and analysis on mobile apps during the build process. However, a vulnerability has been identified in the plugin that exposes proxy passwords stored in plain text in the job configuration files (config.xml). This vulnerability can be exploited by users with Extended Read permission or access to the Jenkins controller file system.
Vulnerability Detail
The vulnerability (CVE-2019-10413) in the Data Theorem Mobile Security: CI/CD Plugin allows unauthorized users to view the unencrypted proxy password stored in the job configuration files. This can lead to potential misuse of the proxy credentials and unauthorized access to sensitive resources. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-522.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the plugin to the latest version.
Conclusion
The Data Theorem Mobile Security: CI/CD Plugin has been found to have a vulnerability that exposes proxy passwords stored in plain text. To mitigate this vulnerability, it is crucial to update the plugin to version 1.4.0 or later, which encrypts the proxy password. Restricting access to the Jenkins controller file system and reviewing user permissions can further enhance security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.datatheorem.mobileappsecurity.jenkins.plugin:datatheorem-mobile-app-security →
FAQ
This vulnerability allows unauthorized users to view the proxy password stored in plain text, potentially leading to unauthorized access to sensitive resources.
Users with Extended Read permission or access to the Jenkins controller file system can exploit this vulnerability.
Yes, updating the Data Theorem Mobile Security: CI/CD Plugin to version 1.4.0 or later fixes this vulnerability.
There are no known instances of this vulnerability being exploited at the moment.
In addition to updating the plugin, it is recommended to restrict access to the Jenkins controller file system and review user permissions to minimize the risk of unauthorized access.
