CVE-2019-10428: Aqua Security Scanner Plugin - Plain Text Password Exposure
Summary
CVE-2019-10428: Jenkins Aqua Security Scanner Plugin showed plain text password in configuration form. Affects org.jenkins-ci.plugins:aqua-security-scanner versions < 3.0.18. Fixed in 3.0.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Aqua Security Scanner Plugin is a Maven package used in Jenkins, an open-source automation server. It provides security scanning capabilities for containerized applications. The plugin allows users to configure credentials for authentication purposes. However, versions 3.0.17 and earlier of the plugin transmitted these configured credentials in plain text as part of the global Jenkins configuration form. This vulnerability potentially exposes the credentials to unauthorized access.
Vulnerability Detail
The vulnerability (CVE-2019-10428) in the Aqua Security Scanner Plugin arises from the transmission of configured credentials in plain text. When users enter their credentials in the global Jenkins configuration form, the plugin does not encrypt or protect the sensitive information. As a result, an attacker with access to the configuration form or network traffic may intercept and obtain the plain text credentials. This could lead to unauthorized access to the associated systems or services.
How To Fix
Minimum fixed version
3.0.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid entering sensitive credentials in the global Jenkins configuration form. Instead, they can provide the credentials directly through secure environment variables or other secure means supported by Jenkins. This ensures that the credentials are not transmitted in plain text and mitigates the risk of exposure.
Conclusion
The Aqua Security Scanner Plugin versions 3.0.17 and earlier are vulnerable to the exposure of plain text credentials. To address this issue, users should upgrade to version 3.0.18 or later. Alternatively, they can employ secure methods of providing credentials to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:aqua-security-scanner →
FAQ
The vulnerability exposes configured credentials in plain text, potentially allowing unauthorized access to associated systems or services.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
There are no known exploits for this vulnerability at the moment. However, it is crucial to address the issue promptly to prevent potential unauthorized access.
Yes, you can mitigate the risk by avoiding the use of the global Jenkins configuration form for entering sensitive credentials. Instead, utilize secure environment variables or other secure means supported by Jenkins.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:aqua-security-scanner.
