CVE-2020-2313: Missing permission checks in Jenkins Azure Key Vault Plugin allow enumerating credentials IDs
Summary
CVE-2020-2313: Missing permission checks in Jenkins Azure Key Vault Plugin allow enumerating credentials IDs. Affects org.jenkins-ci.plugins:azure-keyvault versions < 2.1. Fixed in 2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Azure Key Vault Plugin is a plugin for Jenkins, an open-source automation server. It allows users to securely store and retrieve credentials from Azure Key Vault, a cloud-based service for managing cryptographic keys and secrets. The plugin integrates Jenkins with Azure Key Vault, providing a convenient way to manage credentials used in Jenkins jobs. However, versions 2.0 and earlier of the plugin have a vulnerability that allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability.
Vulnerability Detail
The vulnerability in Azure Key Vault Plugin 2.0 and earlier is due to missing permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. By enumerating the credentials IDs, an attacker can gather information about the stored credentials, which can be used in further attacks to capture the credentials. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of the Azure Key Vault Plugin.
Conclusion
The Azure Key Vault Plugin 2.0 and earlier have a vulnerability that allows attackers to enumerate credentials IDs. This can be used as part of an attack to capture the credentials. To fix this vulnerability, it is recommended to upgrade to version 2.1 or later of the plugin. Vulert's playground can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:azure-keyvault →
FAQ
The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Yes, upgrading to version 2.1 or later of the Azure Key Vault Plugin will fix this vulnerability.
There are no specific workarounds mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of the Azure Key Vault Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:azure-keyvault.
