CVE-2020-2155: Plain Text Transmission of Credentials in OpenShift Deployer Plugin
Summary
CVE-2020-2155: Credentials transmitted in plain text by OpenShift Deployer Plugin. Affects org.jenkins-ci.plugins:openshift-deployer versions < 1.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OpenShift Deployer Plugin is a component of Jenkins, an open-source automation server. It allows users to deploy applications to OpenShift, a container platform. The plugin stores credentials in its global configuration file org.jenkinsci.plugins.openshift.DeployApplication.xml on the Jenkins controller. While the credentials are encrypted on disk, they are transmitted in plain text as part of the configuration form by OpenShift Deployer Plugin 1.2.0 and earlier. This can lead to the exposure of credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Vulnerability Detail
The vulnerability (CVE-2020-2155) arises from the OpenShift Deployer Plugin transmitting credentials in plain text. Although the credentials are encrypted on disk, their transmission in plain text poses a security risk. Attackers could potentially intercept the plain text transmission and gain access to the credentials. This vulnerability has a CVSS score of 3.1, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by avoiding the use of browser extensions and ensuring the security of their Jenkins environment. It is crucial to regularly update the OpenShift Deployer Plugin to the latest secure version.
Conclusion
The OpenShift Deployer Plugin is vulnerable to CVE-2020-2155, which involves the plain text transmission of credentials. To mitigate this vulnerability, users should upgrade to a secure version of the plugin and follow best practices for securing their Jenkins environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:openshift-deployer →
FAQ
The OpenShift Deployer Plugin is a Jenkins plugin that enables the deployment of applications to OpenShift, a container platform.
The OpenShift Deployer Plugin stores credentials in its global configuration file org.jenkinsci.plugins.openshift.DeployApplication.xml on the Jenkins controller.
Yes, the credentials are encrypted on disk. However, they are transmitted in plain text as part of the configuration form.
The plain text transmission of credentials can expose them to interception by attackers, leading to unauthorized access to sensitive information.
This vulnerability has a CVSS score of 3.1, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:openshift-deployer.
