CVE-2020-2124: Password stored in plain text by Dynamic Extended Choice Parameter Plugin
Summary
CVE-2020-2124: Password stored in plain text by Dynamic Extended Choice Parameter Plugin. Affects com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Dynamic Extended Choice Parameter Plugin is a plugin for Jenkins, an open-source automation server. It provides extended choice parameter functionality, allowing users to define dynamic parameters for Jenkins jobs. The plugin is commonly used to enhance the flexibility and customization of Jenkins job configurations. However, versions 1.0.1 and earlier of the plugin have a vulnerability that results in the storage of passwords in plain text within job config.xml files on the Jenkins master. This vulnerability exposes the passwords to users with Extended Read permission or access to the master file system.
Vulnerability Detail
The vulnerability in the Dynamic Extended Choice Parameter Plugin allows passwords to be stored in plain text, which can be viewed by unauthorized users. This can lead to potential security breaches and unauthorized access to sensitive information. The passwords are stored unencrypted in job config.xml files on the Jenkins master, making them easily accessible to anyone with the necessary permissions or file system access. The impact of this vulnerability depends on the sensitivity of the passwords stored and the level of access granted to unauthorized users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by restricting access to the Jenkins master and ensuring that only authorized users have Extended Read permission or access to the file system. Additionally, it is recommended to regularly monitor and review the job config.xml files for any exposed passwords.
Conclusion
The Dynamic Extended Choice Parameter Plugin versions 1.0.1 and earlier have a vulnerability that allows passwords to be stored in plain text, exposing them to unauthorized users. To mitigate this risk, it is recommended to upgrade to a version of the plugin that addresses this issue. Regular monitoring and review of job config.xml files is also advised to ensure the security of sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter →
FAQ
The impact of this vulnerability depends on the sensitivity of the passwords stored and the level of access granted to unauthorized users. It can potentially lead to security breaches and unauthorized access to sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including CVE-2020-2124.
There are no known public exploits specifically targeting this vulnerability at the time of this report. However, it is important to address the vulnerability promptly to prevent any potential security breaches.
Yes, a patch has been released to address this vulnerability. Users should upgrade to a version of the Dynamic Extended Choice Parameter Plugin that is not affected by this issue.
While it is technically possible to manually encrypt the passwords in the job config.xml files, it is not recommended as it may introduce additional complexities and potential security risks. It is best to rely on the updated version of the plugin that properly encrypts the passwords.
Related vulnerabilities
Recent vulnerabilities recorded for com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
