CVE-2020-2127: Credential stored in plain text by BMC Release Package and Deployment Plugin
Summary
CVE-2020-2127: Credential stored in plain text by BMC Release Package and Deployment Plugin. Affects RPD:bmc-rpd versions < 1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The BMC Release Package and Deployment (RPD) Plugin is a Maven package that is used in Jenkins to facilitate the release and deployment of software packages. It provides functionality for managing credentials and configuring deployment processes. The plugin is widely used in software development and deployment workflows.
Vulnerability Detail
The RPD Plugin version 1.1 and earlier stores credentials in plain text in its global configuration file on the Jenkins master. This means that the credentials can be easily accessed by users with access to the master file system. The vulnerability poses a risk of unauthorized access to sensitive information, such as usernames and passwords, which can lead to further security breaches and compromise of the system. As of now, there is no fix available for this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available at the moment, users can consider implementing the following workaround:
- Remove any sensitive credentials from the RPD Plugin configuration.
- Regularly monitor the Jenkins master file system for any unauthorized access or modifications.
- Restrict access to the Jenkins master file system to trusted personnel only.
Conclusion
The BMC Release Package and Deployment Plugin (RPD) version 1.1 and earlier stores credentials in plain text, making them vulnerable to unauthorized access. This can lead to security breaches and compromise the software deployment process. It is recommended to follow the provided workaround and monitor for updates from the plugin developers. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for RPD:bmc-rpd →
FAQ
This vulnerability allows unauthorized users with access to the Jenkins master file system to view sensitive credentials stored by the RPD Plugin. This can lead to unauthorized access to systems and potentially compromise the security of the software deployment process.
As of now, there is no fix available for this vulnerability. Users are advised to follow the recommended workaround and monitor for updates from the plugin developers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
For more information about this vulnerability, you can contact info@devnack.com or visit Vulert's website at https://vulert.com.
