CVE-2020-2129: Plaintext Storage of a Password in Jenkins Eagle Tester Plugin
Summary
CVE-2020-2129: Plaintext Storage of a Password in Jenkins Eagle Tester Plugin. Affects com.mobileenerlytics.eagle.tester:eagle-tester versions < 1.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Eagle Tester Plugin is a Maven package named com.mobileenerlytics.eagle.tester:eagle-tester. It is a plugin for the Jenkins automation server that allows users to perform testing on mobile applications. The plugin is responsible for managing the testing process and storing configuration settings. However, versions 1.0.9 and earlier of the plugin have a vulnerability that exposes a password in plaintext in the global configuration file on the Jenkins master. This means that users with access to the master file system can view the password.
Vulnerability Detail
The vulnerability in the Jenkins Eagle Tester Plugin arises from the insecure storage of a password in its global configuration file. This file is stored on the Jenkins master and is accessible to users with file system access. By storing the password in plaintext, it becomes easily readable by anyone with access to the file. This can lead to unauthorized access to sensitive information or systems. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually encrypt or hash the password before storing it in the configuration file. This can be done using cryptographic libraries or functions available in the programming language used for the Jenkins configuration. However, it is strongly advised to update to the latest version of the plugin as soon as possible.
Conclusion
The Jenkins Eagle Tester Plugin has a vulnerability that allows a password to be stored in plaintext in its configuration file. This can lead to unauthorized access to sensitive information or systems. To mitigate the vulnerability, users should upgrade to version 1.1.0 or later of the plugin, where the password is stored securely. In the meantime, a temporary workaround is to manually encrypt or hash the password before storing it. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.mobileenerlytics.eagle.tester:eagle-tester →
FAQ
The vulnerability allows unauthorized users with file system access to view the password stored in the Jenkins Eagle Tester Plugin's configuration file. This can lead to unauthorized access to sensitive information or systems.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for any vulnerable dependencies.
Yes, a fix is available for this vulnerability. Users should upgrade to version 1.1.0 or later of the Jenkins Eagle Tester Plugin, where the password is stored securely.
Yes, as a temporary workaround, you can manually encrypt or hash the password before storing it in the configuration file. However, it is strongly recommended to update to the latest version of the plugin as soon as possible.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing the vulnerability.
