CVE-2020-2150: Jenkins Sonar Quality Gates Plugin plaintext credential transmission
Summary
CVE-2020-2150: Jenkins Sonar Quality Gates Plugin transmits credentials in plain text during configuration. Affects org.jenkins-ci.plugins:sonar-quality-gates versions < 1.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Sonar Quality Gates Plugin is an open-source plugin that integrates Jenkins with SonarQube, a platform for continuous code quality inspection. This plugin allows users to define quality gates and enforce them as part of their Jenkins pipeline. It stores credentials in its global configuration file on the Jenkins controller. The credentials are encrypted on disk but transmitted in plaintext during the configuration process.
Vulnerability Detail
The vulnerability (CVE-2020-2150) in the Sonar Quality Gates Plugin arises from the transmission of credentials in plaintext during the configuration process. While the credentials are stored encrypted on disk, their transmission in plaintext exposes them to potential risks. This includes exposure through browser extensions, cross-site scripting vulnerabilities, and similar situations. Attackers with access to network traffic or compromised systems may be able to intercept and obtain these credentials, potentially leading to unauthorized access or other malicious activities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by following security best practices such as restricting access to the Jenkins controller, using secure network connections, and regularly monitoring for any unauthorized access or suspicious activities.
Conclusion
The Jenkins Sonar Quality Gates Plugin is vulnerable to plaintext credential transmission during the configuration process. This can lead to potential exposure of credentials and subsequent unauthorized access or malicious activities. Upgrading to the latest version of the plugin (1.3.2 or later) is recommended to address the vulnerability. Following security best practices and regularly monitoring for any unauthorized access can further mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:sonar-quality-gates →
FAQ
The vulnerability exposes credentials to potential interception, which can lead to unauthorized access or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to address the vulnerability promptly to mitigate any potential risks.
Yes, a fix is available in Sonar Quality Gates Plugin version 1.3.2 or later. It is recommended to upgrade to the latest version to address the vulnerability.
To mitigate this vulnerability, it is recommended to restrict access to the Jenkins controller, use secure network connections, and regularly monitor for any unauthorized access or suspicious activities.
