CVE-2020-2291: Password stored in plain text by Jenkins couchdb-statistics Plugin
Summary
CVE-2020-2291: Password stored in plain text by Jenkins couchdb-statistics Plugin. Affects org.jenkins-ci.plugins:couchdb-statistics versions < 0.4. Fixed in 0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins couchdb-statistics Plugin is a Maven package that provides functionality for storing and retrieving statistics from a CouchDB server. It is commonly used in Jenkins instances to track and analyze various metrics related to builds and deployments. The plugin allows users to configure a connection to a CouchDB server, including providing a username and password for authentication. However, versions 0.3 and earlier of the plugin store the server password in plain text in the global configuration file org.jenkinsci.plugins.couchstats.CouchStatsConfig.xml on the Jenkins controller. This means that anyone with access to the Jenkins controller file system can view the password, potentially leading to unauthorized access to the CouchDB server and its data.
Vulnerability Detail
The vulnerability (CVE-2020-2291) arises from the insecure storage of the server password by the couchdb-statistics Plugin. The password is stored unencrypted in the global configuration file, making it easily accessible to users with file system access. This can result in unauthorized access to the CouchDB server and potential compromise of sensitive data. The vulnerability has a CVSS score of 3.3, indicating a low severity level.
How To Fix
Minimum fixed version
0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can manually encrypt the password in the configuration file or restrict file system access to prevent unauthorized viewing of the password.
Conclusion
The Jenkins couchdb-statistics Plugin suffers from a vulnerability that allows the server password to be stored in plain text, potentially leading to unauthorized access to the CouchDB server. To fix this issue, it is recommended to upgrade to version 0.4 or later of the plugin, which encrypts the password in the configuration file. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:couchdb-statistics →
FAQ
The vulnerability allows unauthorized users with file system access to view the CouchDB server password, potentially leading to unauthorized access and compromise of sensitive data.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, upgrading to version 0.4 or later of the couchdb-statistics Plugin fixes this vulnerability by encrypting the server password in the configuration file.
Yes, it is possible to manually encrypt the password in the configuration file to mitigate the vulnerability. However, upgrading to the latest version of the plugin is recommended for better security.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
