CVE-2020-2239: Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin
Summary
CVE-2020-2239: Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin. Affects org.jenkins-ci.plugins:Parameterized-Remote-Trigger versions < 3.1.4. Fixed in 3.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Parameterized Remote Trigger Plugin is a tool used for triggering remote builds on Jenkins servers. It allows users to configure and trigger builds on remote Jenkins instances. The plugin stores a secret unencrypted in its global configuration file org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml on the Jenkins controller. This secret is a part of the plugin's configuration and can be accessed by attackers with file system access to the Jenkins controller. The vulnerability affects Parameterized Remote Trigger Plugin versions 3.1.3 and earlier. The issue has been addressed in version 3.1.4, where the secret is stored encrypted after the configuration is saved again.
Vulnerability Detail
The vulnerability in the Parameterized Remote Trigger Plugin allows an attacker with access to the Jenkins controller file system to view the secret stored in plain text. This secret can potentially be used by an attacker to gain unauthorized access to remote Jenkins instances or perform other malicious activities. The vulnerability has a CVSS score of 3.3, indicating a low severity level. The CWE ID associated with this vulnerability is CWE-256.
How To Fix
Minimum fixed version
3.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the plugin.
Conclusion
The Parameterized Remote Trigger Plugin in Jenkins versions 3.1.3 and earlier stores a secret unencrypted, making it vulnerable to unauthorized access by attackers with file system access to the Jenkins controller. Upgrading to version 3.1.4 or later fixes this vulnerability by encrypting the secret. It is recommended to update Jenkins installations and ensure that the plugin is updated to the latest version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:Parameterized-Remote-Trigger →
FAQ
The vulnerability allows attackers with file system access to the Jenkins controller to view the secret stored in plain text. This secret can potentially be used to gain unauthorized access to remote Jenkins instances or perform other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
Yes, the vulnerability has been fixed in Parameterized Remote Trigger Plugin version 3.1.4. It is recommended to upgrade to this version to secure your Jenkins installation.
There are no specific workarounds mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the plugin.
The vulnerability has a CVSS score of 3.3, indicating a low severity level.
