CVE-2019-10460: Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials
Summary
CVE-2019-10460: Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials. Affects org.jenkins-ci.plugins:bitbucket-oauth versions < 0.10. Fixed in 0.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Bitbucket OAuth Plugin is a Maven package that provides integration between Jenkins and Bitbucket OAuth. It allows users to authenticate and authorize Jenkins access using their Bitbucket credentials. The plugin is widely used in Jenkins installations to streamline the authentication process and enhance security. However, prior to version 0.10, the plugin stored credentials in an unencrypted format in the global config.xml configuration file on the Jenkins master. This vulnerability exposes the credentials to users with access to the master file system.
Vulnerability Detail
The vulnerability (CVE-2019-10460) in the Jenkins Bitbucket OAuth Plugin arises from the insecure storage of credentials. As a result, users with access to the Jenkins master file system can view the unencrypted credentials stored in the global config.xml file. This can lead to unauthorized access to Bitbucket repositories and potentially compromise sensitive data. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
0.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to upgrade to the latest version of the Jenkins Bitbucket OAuth Plugin as soon as possible.
Conclusion
The Jenkins Bitbucket OAuth Plugin prior to version 0.10 suffers from the vulnerability (CVE-2019-10460) that exposes unencrypted credentials in the global config.xml file. To mitigate this risk, users should upgrade to the latest version of the plugin, which ensures proper encryption and protection of credentials. It is important to promptly address this vulnerability to prevent unauthorized access to Bitbucket repositories and potential data compromise. For additional support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:bitbucket-oauth →
FAQ
The vulnerability allows unauthorized users with access to the Jenkins master file system to view unencrypted credentials, potentially leading to unauthorized access to Bitbucket repositories and data compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if the vulnerability is detected.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to upgrade to the latest version of the Jenkins Bitbucket OAuth Plugin to mitigate the risk.
No, this vulnerability requires access to the Jenkins master file system. Remote exploitation is not possible.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in securing your Jenkins installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:bitbucket-oauth.
