CVE-2020-2156: Credentials transmitted in plain text by Jenkins DeployHub Plugin
Summary
CVE-2020-2156: Credentials transmitted in plain text by Jenkins DeployHub Plugin. Affects com.openmake:deployhub versions < 8.0.14. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins DeployHub Plugin is a Maven package (com.openmake:deployhub) that provides functionality for deploying applications. It is commonly used in software development and deployment processes. The plugin allows users to configure deployment settings and store credentials for authentication. However, prior to version 8.0.15, the plugin had a vulnerability where credentials were transmitted in plain text during the configuration process. Although the credentials were encrypted when stored on disk, users with Extended Read permission could view them. This vulnerability poses a risk to the confidentiality of sensitive information, such as usernames and passwords.
Vulnerability Detail
The vulnerability in the Jenkins DeployHub Plugin (com.openmake:deployhub) allows for the transmission of credentials in plain text during the configuration process. This means that while the credentials are encrypted when stored on disk, they can be intercepted and viewed by users with Extended Read permission. The impact of this vulnerability is the potential exposure of sensitive information, which could lead to unauthorized access to systems or accounts. The vulnerability has a CVSS score of 3.1, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the Jenkins DeployHub Plugin to mitigate the risk.
Conclusion
The Jenkins DeployHub Plugin (com.openmake:deployhub) prior to version 8.0.15 has a vulnerability that allows for the transmission of credentials in plain text. This can lead to the exposure of sensitive information and unauthorized access. Users should upgrade to the latest version of the plugin to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.openmake:deployhub →
FAQ
The Jenkins DeployHub Plugin is a Maven package that provides functionality for deploying applications. It is commonly used in software development and deployment processes.
The vulnerability allows for the transmission of credentials in plain text, potentially exposing sensitive information to unauthorized users.
To fix this vulnerability, upgrade to version 8.0.15 or later of the Jenkins DeployHub Plugin.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the Jenkins DeployHub Plugin.
The CVSS score of this vulnerability is 3.1, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.openmake:deployhub.
