CVE-2022-34799: Plaintext Storage of a Password in Jenkins Deployment Dashboard Plugin
Summary
CVE-2022-34799: Plaintext Storage of a Password in Jenkins Deployment Dashboard Plugin. Affects org.jenkins-ci.plugins:ec2-deployment-dashboard versions < 1.0.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Deployment Dashboard Plugin is a Maven-based package that provides a dashboard view for managing deployments in Jenkins. It allows users to monitor and control deployments in an EC2 environment. The plugin is widely used in Jenkins installations and provides a convenient interface for managing deployment tasks.
Vulnerability Detail
The Deployment Dashboard Plugin version 1.0.10 and earlier suffers from a vulnerability where it stores a password in plaintext in its global configuration file de.codecentric.jenkins.dashboard.DashboardView.xml. This file is located on the Jenkins controller and contains sensitive information, including the password, without any encryption. As a result, any user with access to the Jenkins controller file system can view the password. This vulnerability poses a risk of unauthorized access to the password and potentially compromising the EC2 environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually encrypt the password in the de.codecentric.jenkins.dashboard.DashboardView.xml file. This can be done by using a secure encryption algorithm and updating the file with the encrypted password. However, this workaround is not recommended as it requires manual intervention and may introduce additional security risks.
Conclusion
The vulnerability in the Jenkins Deployment Dashboard Plugin allows the plaintext storage of a password in its global configuration file, posing a risk of unauthorized access to the password and potential compromise of the EC2 environment. It is crucial to update the plugin to version 1.0.11 or later to ensure the password is securely stored. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ec2-deployment-dashboard →
FAQ
This vulnerability allows any user with access to the Jenkins controller file system to view the password stored in plaintext. This can lead to unauthorized access to the EC2 environment and potential compromise of sensitive data.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can easily check the vulnerability status of your application without any signup or installation.
Yes, the developers of the Deployment Dashboard Plugin have released a fix in version 1.0.11. It is recommended to update your Jenkins installation to the latest version of the plugin to address this vulnerability.
Yes, as a temporary workaround, you can manually encrypt the password in the de.codecentric.jenkins.dashboard.DashboardView.xml file. However, this workaround is not recommended as it requires manual intervention and may introduce additional security risks.
You can find more information about this vulnerability in the GitHub Security Advisory database (https://github.com/github/advisory-database) under the identifier GHSA-56hc-wf49-2h96.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ec2-deployment-dashboard.
