CVE-2020-2133: Password stored in plain text by Applatix Plugin
Summary
CVE-2020-2133: Password stored in plain text by Applatix Plugin. Affects com.applatix.jenkins:applatix versions < 1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Applatix Plugin is a component of Jenkins, an open-source automation server. It provides functionality for integrating with the Applatix platform. The plugin allows users to configure and manage jobs in Jenkins that interact with the Applatix platform. It is commonly used in CI/CD pipelines to automate software development processes. However, the plugin has a vulnerability that results in the storage of passwords in plain text in job configuration files on the Jenkins master. This vulnerability can be exploited by users with Extended Read permission or access to the master file system.
Vulnerability Detail
The vulnerability in the Applatix Plugin allows passwords to be stored in plain text, which can be viewed by unauthorized users. This poses a security risk as sensitive credentials can be easily accessed and misused. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level. The CWE identifiers associated with this vulnerability are CWE-256 and CWE-522.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only authorized users have access to the Jenkins master and job configuration files. It is also recommended to regularly monitor and audit access to these files.
Conclusion
The Applatix Plugin in Jenkins has a vulnerability that allows passwords to be stored in plain text, posing a security risk. Users should upgrade to version 1.2 or later to address this issue. It is also important to review and update any job configuration files that may contain passwords in plain text. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.applatix.jenkins:applatix →
FAQ
The impact of this vulnerability is that passwords are stored in plain text, making them easily accessible to unauthorized users. This can lead to unauthorized access to sensitive systems and data.
Users of Jenkins Applatix Plugin versions 1.1 and earlier are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, this vulnerability has been fixed in Jenkins Applatix Plugin version 1.2 and later.
If you suspect unauthorized access to your Jenkins master, it is recommended to investigate the issue immediately. Review access logs, change passwords, and consider implementing additional security measures such as two-factor authentication.
