CVE-2020-2198: Missing permission check in Jenkins Project Inheritance Plugin
Summary
CVE-2020-2198: Missing permission check in Jenkins Project Inheritance Plugin. Affects hudson.plugins:project-inheritance versions < 21.04.03. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Project Inheritance Plugin is a Maven package that provides functionality for project inheritance in Jenkins. It allows users to define a base project configuration and inherit it across multiple projects, reducing duplication and simplifying maintenance. This plugin is widely used in Jenkins environments.
Vulnerability Detail
The Jenkins Project Inheritance Plugin version 21.04.03 and earlier has a vulnerability that allows unauthorized users to access sensitive information. Specifically, the 'getConfigAsXML' API URL does not properly redact encrypted secrets when transmitting job config.xml data to users without Job/Configure permissions. This means that encrypted secrets can be exposed to unauthorized users, potentially leading to unauthorized access or data leakage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the 'getConfigAsXML' API URL by configuring appropriate permissions. This can be done by limiting access to the URL or by restricting the Job/Configure permissions for unauthorized users. Here is an example of how to restrict access to the URL using the Jenkins Script Console:
import jenkins.model.Jenkins
Jenkins.instance.getDescriptor("hudson.plugins.project_inheritance.ProjectInheritancePlugin").getConfigAsXMLPermission().setRoles(["authenticated"])
Jenkins.instance.save()
This script sets the roles allowed to access the 'getConfigAsXML' API URL to only authenticated users.
Conclusion
The Jenkins Project Inheritance Plugin has a vulnerability that allows unauthorized users to access encrypted secrets. It is important to upgrade to a non-affected version of the plugin and ensure proper permissions are set to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for hudson.plugins:project-inheritance →
FAQ
This vulnerability allows unauthorized users to access encrypted secrets in the Jenkins Project Inheritance Plugin. This can potentially lead to unauthorized access or data leakage.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply enter your pom.xml file and the Vulert Playground will analyze it for open-source vulnerabilities, including this one.
There are currently no known exploits for this vulnerability. However, it is important to patch your Jenkins Project Inheritance Plugin installation as soon as possible to prevent any potential unauthorized access or data leakage.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing this vulnerability in your Jenkins environment.
Related vulnerabilities
Recent vulnerabilities recorded for hudson.plugins:project-inheritance.
