CVE-2020-2153: Credentials transmitted in plain text by Backlog Plugin
Summary
CVE-2020-2153: Credentials transmitted in plain text by Backlog Plugin. Affects org.jenkins-ci.plugins:backlog versions < 2.5. Fixed in 2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Backlog Plugin is a Maven package that is used in Jenkins, an open-source automation server. It provides functionality for managing and tracking issues, tasks, and projects. The plugin allows users to store credentials in job configuration files (config.xml) as part of its configuration. These credentials are used for authentication and authorization purposes within Jenkins.
Vulnerability Detail
The Backlog Plugin version 2.4 and earlier stores credentials in plain text in the configuration form, which can be accessed by users with Extended Read permission. Although the credentials are encrypted on disk, they are transmitted in plain text, making them vulnerable to interception. This vulnerability could potentially lead to unauthorized access to sensitive information and compromise the security of the Jenkins instance.
How To Fix
Minimum fixed version
2.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the Backlog Plugin to address the issue.
Conclusion
The Backlog Plugin vulnerability (CVE-2020-2153) exposes credentials transmitted in plain text, potentially leading to unauthorized access and compromising the security of the Jenkins instance. It is crucial to update to Backlog Plugin version 2.5 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:backlog →
FAQ
This vulnerability allows users with Extended Read permission to view credentials transmitted in plain text. It could potentially lead to unauthorized access to sensitive information and compromise the security of the Jenkins instance.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, the fix for this vulnerability is available in Backlog Plugin version 2.5 or later. It is recommended to update your Jenkins installation to include the latest version of the Backlog Plugin.
No, there are no known workarounds for this vulnerability. It is crucial to update to the fixed version of the Backlog Plugin to address the issue.
To upgrade the Backlog Plugin, follow these steps:
- Access the Jenkins administration console.
- Navigate to the 'Manage Jenkins' section.
- Click on 'Manage Plugins'.
- In the 'Available' tab, search for 'Backlog Plugin'.
- Select the checkbox next to 'Backlog Plugin'.
- Click on the 'Install without restart' button.
- Once the installation is complete, restart Jenkins to apply the changes.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.