CVE-2020-2118: Enumeration of Credential IDs in Pipeline GitHub Notify Step Plugin
Summary
CVE-2020-2118: Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin. Affects org.jenkins-ci.plugins:pipeline-build-step versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Pipeline GitHub Notify Step Plugin is a Jenkins plugin that allows users to send notifications to GitHub repositories from Jenkins pipelines. It provides a convenient way to integrate Jenkins with GitHub and automate various tasks. The plugin is built using the Maven ecosystem and can be identified by the package name 'org.jenkins-ci.plugins:pipeline-build-step'.
Vulnerability Detail
The vulnerability identified as CVE-2020-2118 in the Pipeline GitHub Notify Step Plugin allows users with Overall/Read access to enumerate credential IDs. This means that any user with the necessary permissions can obtain a list of valid credential IDs used by the plugin. This information can be exploited in conjunction with another vulnerability to capture the credentials. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the fixed version of the plugin.
Conclusion
The CVE-2020-2118 vulnerability in the Pipeline GitHub Notify Step Plugin allows users with Overall/Read access to enumerate credential IDs, potentially leading to unauthorized access or other security breaches. To fix this vulnerability, it is crucial to upgrade to version 1.0.5 or later of the plugin. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-build-step →
FAQ
The vulnerability allows users with Overall/Read access to obtain a list of valid credential IDs used by the plugin. This information can be used in an attack to capture the credentials, potentially leading to unauthorized access or other security breaches.
Users of Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier are affected by this vulnerability. Specifically, users with Overall/Read access permissions are at risk.
There are no known exploits for this vulnerability at the time of this report. However, it is important to address the vulnerability promptly by upgrading to the fixed version of the plugin.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
It is recommended to upgrade to the fixed version of the plugin as soon as possible to mitigate the vulnerability. Prompt action is advised to ensure the security of the Jenkins environment.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-build-step.
