CVE-2020-2130: Harvest SCM Plugin - Passwords stored in plain text
Summary
CVE-2020-2130: Passwords stored in plain text by Harvest SCM Plugin. Affects org.jenkins-ci.plugins:harvest versions < 0.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Harvest SCM Plugin is a Maven package that is used in Jenkins, an open-source automation server. It provides integration with the Harvest Software Configuration Management (SCM) system. The plugin allows users to configure and manage their Harvest SCM credentials within Jenkins. However, versions 0.5.1 and earlier of the Harvest SCM Plugin have a vulnerability that stores SCM passwords in plain text. These passwords are stored in the global configuration file hudson.plugins.harvest.HarvestSCM.xml and in the job config.xml files on the Jenkins controller. This vulnerability exposes the passwords to users with Extended Read permission or access to the Jenkins controller file system.
Vulnerability Detail
The vulnerability in the Harvest SCM Plugin allows unauthorized users to view SCM passwords stored in plain text. This can lead to unauthorized access to the Harvest SCM system and potentially compromise sensitive information. The passwords are stored in the global configuration file and job configuration files, making them accessible to users with certain permissions or file system access. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have access to the Jenkins controller file system and by restricting permissions for viewing job configuration files. Additionally, users can consider using a different SCM plugin that does not have this vulnerability.
Conclusion
The Harvest SCM Plugin versions 0.5.1 and earlier have a vulnerability that stores SCM passwords in plain text, potentially exposing them to unauthorized users. To mitigate this risk, it is crucial to upgrade to version 0.5.2 or later, which addresses this issue by encrypting the passwords. Additionally, users should ensure that only trusted users have access to the Jenkins controller file system and consider using alternative SCM plugins if possible. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:harvest →
FAQ
The vulnerability allows unauthorized users to view SCM passwords stored in plain text, potentially leading to unauthorized access to the Harvest SCM system and exposure of sensitive information.
Users of Harvest SCM Plugin versions 0.5.1 and earlier in Jenkins installations are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known exploits for this vulnerability at the time of this report. However, it is important to address the vulnerability promptly to prevent any potential unauthorized access.
Users can consider using alternative SCM plugins for Jenkins that do not have this vulnerability. It is recommended to evaluate and choose a plugin that meets your specific requirements and has a good track record of security.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:harvest.
