CVE-2020-2218: Password stored in plain text by Jenkins HP ALM Quality Center Plugin
Summary
CVE-2020-2218: Password stored in plain text by Jenkins HP ALM Quality Center Plugin. Affects org.jenkins-ci.plugins:hp-quality-center versions < 1.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins HP ALM Quality Center Plugin is a Maven package that provides integration between Jenkins and HP ALM Quality Center. It allows users to automate the testing and quality assurance processes within their Jenkins pipelines. The plugin stores configuration information, including a password, in a global configuration file called org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml. This file is located on the Jenkins controller file system. The stored password is not encrypted or hashed, making it vulnerable to unauthorized access.
Vulnerability Detail
The vulnerability (CVE-2020-2218) arises from the insecure storage of a password in plain text format. Any user with access to the Jenkins controller file system can view the password stored in the org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml file. This can lead to unauthorized access to the HP ALM Quality Center integration and potentially compromise sensitive information or disrupt the testing and quality assurance processes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can manually encrypt the password stored in the org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml file to mitigate the risk of unauthorized access. This can be done by using encryption libraries or techniques provided by the programming language or framework being used.
Conclusion
In conclusion, the Jenkins HP ALM Quality Center Plugin version 1.6 and earlier stores a password in plain text, making it vulnerable to unauthorized access. To mitigate this vulnerability, it is crucial to update the plugin to version 1.7 or later, which encrypts the stored password. Additionally, it is important to restrict access to the Jenkins controller file system and follow best practices for securing sensitive information.
See every vulnerability recorded for org.jenkins-ci.plugins:hp-quality-center →
FAQ
The vulnerability allows unauthorized users with access to the Jenkins controller file system to view the password stored in plain text. This can lead to unauthorized access to the HP ALM Quality Center integration and potential compromise of sensitive information or disruption of testing processes.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, including this one, using just the pom.xml file.
Yes, a fix is available for this vulnerability. It is recommended to update the Jenkins HP ALM Quality Center Plugin to version 1.7 or later, where the password is encrypted in the configuration file.
Yes, you can manually encrypt the password stored in the org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml file. Use encryption libraries or techniques provided by your programming language or framework to ensure the password is securely stored.
To protect the Jenkins controller file system, ensure that only trusted individuals have access to it. Implement proper access controls, restrict file system access to authorized personnel, and regularly monitor and audit file system activities.
