CVE-2020-2213: Credentials stored in plain text by Jenkins White Source Plugin
Summary
CVE-2020-2213: Credentials stored in plain text by Jenkins White Source Plugin. Affects org.jenkins-ci.plugins:whitesource versions < 20.8.1. Fixed in 20.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins White Source Plugin is a Maven package that provides integration with the White Source platform. It allows users to automatically manage and track open-source components in their projects. The plugin is widely used in Jenkins environments to ensure the security and compliance of software applications.
Vulnerability Detail
The White Source Plugin prior to version 20.8.1 has a vulnerability where it stores credentials in plain text. These credentials are stored in the global configuration file org.whitesource.jenkins.pipeline.WhiteSourcePipelineStep.xml and job config.xml files on the Jenkins controller. This means that users with Extended Read permission or access to the Jenkins controller file system can view these credentials. The issue has a CVSS score of 4.3, indicating a moderate severity level. The vulnerability is identified as CWE-256.
How To Fix
Minimum fixed version
20.8.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched version of the White Source Plugin.
Conclusion
The Jenkins White Source Plugin prior to version 20.8.1 has a vulnerability that allows credentials to be stored in plain text. This can lead to unauthorized access to sensitive information. It is recommended to upgrade to version 20.8.1 or later of the plugin to fix this vulnerability. For further support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:whitesource →
FAQ
The vulnerability allows users with certain permissions or access to the Jenkins controller file system to view credentials stored in plain text. This can lead to unauthorized access to sensitive information and potential security breaches.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the pom.xml file for analysis.
There are no known exploits for this vulnerability at the time of this advisory. However, it is important to apply the recommended fix to prevent any potential unauthorized access to credentials.
Manually removing the plain text credentials from the configuration files is not recommended, as it may cause issues with the functionality of the White Source Plugin. It is best to upgrade to the patched version of the plugin to ensure proper security measures.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability in your Jenkins environment.
