CVE-2019-10415: Jenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials
Summary
CVE-2019-10415: Jenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials. Affects org.jenkins-ci.plugins:violation-comments-to-gitlab versions < 2.29. Fixed in 2.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Violation Comments to GitLab Plugin is a tool that allows users to send violation comments from Jenkins to GitLab. It is commonly used in software development workflows to provide feedback on code quality and compliance. The plugin integrates with GitLab's API to post comments directly on merge requests and commits. However, prior to version 2.29, the plugin stored API tokens unencrypted in job configuration files and the global configuration file on the Jenkins controller. This made the credentials vulnerable to unauthorized access.
Vulnerability Detail
The vulnerability (CVE-2019-10415) in the Jenkins Violation Comments to GitLab Plugin allowed users with Extended Read permission or access to the Jenkins controller file system to view the unencrypted API tokens stored in job configuration files and the global configuration file. This could potentially lead to unauthorized access to GitLab repositories and sensitive data. The issue was addressed in version 2.29 of the plugin, which introduced encryption for storing credentials.
How To Fix
Minimum fixed version
2.29
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the plugin.
Conclusion
The Jenkins Violation Comments to GitLab Plugin prior to version 2.29 stored API tokens unencrypted, making them vulnerable to unauthorized access. Upgrading to version 2.29 or later ensures that credentials are stored encrypted. Users should take immediate action to upgrade their plugin version and overwrite any existing plain text credentials. For further support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:violation-comments-to-gitlab →
FAQ
The vulnerability exposed unencrypted API tokens, which could be used by unauthorized users to access GitLab repositories and potentially compromise sensitive data.
Users of Jenkins Violation Comments to GitLab Plugin versions prior to 2.29 are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
For further support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:violation-comments-to-gitlab.
