CVE-2020-2157: Credentials transmitted in plain text by Skytap Cloud CI Plugin
Summary
CVE-2020-2157: Credentials transmitted in plain text by Skytap Cloud CI Plugin. Affects org.jenkins-ci.plugins:skytap versions < 2.07. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Skytap Cloud CI Plugin is a Maven package that provides integration between Jenkins and Skytap Cloud. It allows users to create and manage Skytap environments as part of their Jenkins CI/CD workflows. The plugin enables developers to automate the provisioning and configuration of Skytap environments for testing and deployment purposes. However, the plugin is vulnerable to a security issue that involves the transmission of credentials in plain text.
Vulnerability Detail
The Skytap Cloud CI Plugin stores credentials in job config.xml files as part of its configuration. Although the credentials are encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin versions 2.07 and earlier. This means that users with Extended Read permission can potentially view these credentials. The vulnerability has a CVSS score of 3.1, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can revoke the Extended Read permission for users who should not have access to the credentials. This can be done by modifying the permissions settings in the Jenkins configuration. Additionally, users can manually encrypt the credentials before storing them in the config.xml files. This can be achieved using encryption tools or libraries available for the specific programming language or framework being used.
Conclusion
In conclusion, the Skytap Cloud CI Plugin is vulnerable to the transmission of credentials in plain text. This can potentially lead to unauthorized access to sensitive information. Users should upgrade to a non-affected version of the plugin and ensure that the credentials are properly protected. Revoking Extended Read permission and manually encrypting the credentials can also mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:skytap →
FAQ
The vulnerability allows users with Extended Read permission to view the credentials stored in the config.xml files. This could potentially lead to unauthorized access to sensitive information, such as API keys or passwords.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation. Simply provide your pom.xml file to Vulert's playground to check for vulnerabilities.
Yes, there is a patch available for this vulnerability. Users should upgrade to a version of the Skytap Cloud CI Plugin that is not affected by this issue. It is recommended to update to the latest version available.
Yes, you can mitigate the risk by revoking the Extended Read permission for users who should not have access to the credentials. Additionally, you can manually encrypt the credentials before storing them in the config.xml files.
You can find more information about this vulnerability, including the CVE identifier, on the official GitHub Advisory Database (https://github.com/github/advisory-database).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:skytap.
