CVE-2020-2107: Fortify Plugin stored credentials in plain text
Summary
CVE-2020-2107: Fortify Plugin stored credentials in plain text. Affects org.jenkins-ci.plugins:fortify versions < 19.2.30. Fixed in 19.2.30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Fortify Plugin is a Maven package (org.jenkins-ci.plugins:fortify) used in Jenkins, an open-source automation server. It provides integration with Fortify, a software security tool. The plugin allows users to configure a proxy server for communication. However, versions 19.1.29 and earlier stored the proxy server password in plain text in the job config.xml files. This vulnerability allowed users with the Extended Read permission to access the unencrypted password.
Vulnerability Detail
The vulnerability (CVE-2020-2107) in the Fortify Plugin allowed unauthorized users to read the proxy server password stored in plain text. This could lead to potential misuse of the password and unauthorized access to the proxy server. The issue was addressed in version 19.2.30 of the plugin, which now encrypts the proxy server password.
How To Fix
Minimum fixed version
19.2.30
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Fortify Plugin versions 19.1.29 and earlier had a vulnerability that stored the proxy server password in plain text, allowing unauthorized access. Users should upgrade to version 19.2.30 or later to fix this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:fortify →
FAQ
The vulnerability allows unauthorized users to read the proxy server password, potentially leading to unauthorized access to the proxy server.
Users of Fortify Plugin versions 19.1.29 and earlier are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There is no specific workaround for this vulnerability. Upgrading to version 19.2.30 or later of the Fortify Plugin is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xr37-pjfh-qwwc/GHSA-xr37-pjfh-qwwc.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:fortify.
