CVE-2020-2210: Passwords transmitted in plain text by Jenkins Stash Branch Parameter Plugin
Summary
CVE-2020-2210: Passwords transmitted in plain text by Jenkins Stash Branch Parameter Plugin. Affects org.jenkins-ci.plugins:StashBranchParameter versions < 0.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Stash Branch Parameter Plugin is an open-source plugin for the Jenkins automation server. It allows users to define branch parameters based on branches in a Stash repository. The plugin stores Stash API passwords in its global configuration file org.jenkinsci.plugins.StashBranchParameter.StashBranchParameterDefinition.xml on the Jenkins controller. While the password is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Stash Branch Parameter Plugin 0.3.0 and earlier.
Vulnerability Detail
The vulnerability in Jenkins Stash Branch Parameter Plugin allows for the exposure of passwords due to the transmission of the password in plain text. This can occur through browser extensions, cross-site scripting vulnerabilities, or similar situations. The passwords are stored encrypted on disk, but during the configuration process, they are sent in plain text. This vulnerability affects Jenkins versions before 2.236, including 2.235.x LTS. However, Jenkins 2.236 introduces a security hardening measure that encrypts and decrypts data used for a Jenkins password form field.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by upgrading to Jenkins version 2.236 or later.
Conclusion
The Jenkins Stash Branch Parameter Plugin vulnerability (CVE-2020-2210) exposes passwords due to their transmission in plain text. This vulnerability can be mitigated by upgrading Jenkins to version 2.236 or later, which includes a security hardening measure. It is important to address this vulnerability promptly to prevent unauthorized access to sensitive information. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:StashBranchParameter →
FAQ
The impact of this vulnerability is the potential exposure of passwords due to their transmission in plain text. This can lead to unauthorized access to sensitive information and compromised user accounts.
This vulnerability affects Jenkins versions before 2.236, including 2.235.x LTS. Jenkins 2.236 and later versions have implemented a security hardening measure to address this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using the pom.xml file.
There are no known exploits for this vulnerability at the moment. However, it is crucial to address this vulnerability promptly to prevent potential unauthorized access to passwords.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:StashBranchParameter.
