CVE-2020-2277: Arbitrary file read vulnerability in Storable Configs Plugin
Summary
CVE-2020-2277: Arbitrary file read vulnerability in Jenkins Storable Configs Plugin. Affects org.jvnet.hudson.plugins:storable-configs-plugin versions < 1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Storable Configs Plugin is a Maven package (org.jvnet.hudson.plugins:storable-configs-plugin) used in Jenkins, an open-source automation server. This plugin allows users to store and retrieve configuration data for Jenkins jobs. It is vulnerable to an arbitrary file read vulnerability, which can be exploited by users with Job/Read permission to read arbitrary files on the Jenkins controller.
Vulnerability Detail
The arbitrary file read vulnerability in the Storable Configs Plugin allows users with Job/Read permission to access and read any file on the Jenkins controller. This can lead to unauthorized disclosure of sensitive information, such as credentials or configuration files. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The CWE-22 vulnerability category is associated with this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, users can mitigate the risk by restricting Job/Read permission to trusted users only. By carefully managing user permissions, the potential impact of the vulnerability can be minimized.
Conclusion
The Storable Configs Plugin in Jenkins is vulnerable to an arbitrary file read vulnerability. To mitigate the risk, it is recommended to upgrade the plugin to version 1.1 or later. Restricting Job/Read permission to trusted users can also help minimize the impact. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jvnet.hudson.plugins:storable-configs-plugin →
FAQ
The vulnerability allows users with Job/Read permission to read arbitrary files on the Jenkins controller, potentially exposing sensitive information.
To fix the vulnerability, upgrade the Storable Configs Plugin to version 1.1 or later.
Yes, you can restrict Job/Read permission to trusted users to mitigate the risk until the plugin is upgraded.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
This vulnerability is categorized as CWE-22, which relates to improper limitation of a pathname to a restricted directory.
Related vulnerabilities
Recent vulnerabilities recorded for org.jvnet.hudson.plugins:storable-configs-plugin.
