GitHub Advisoryadvisory · Maven

GHSA-wphq-j78p-fhgp Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin

LOW Published 2022-05-24 Modified 2022-12-21 Official page ↗
Aliases
CVE-2020-2239
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:Parameterized-Remote-Trigger
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-256, CWE-311
Reviewed
2022-12-21

Affected packages

• Maven org.jenkins-ci.plugins:Parameterized-Remote-Trigger: < 3.1.4 → fixed in 3.1.4

Description

Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file `org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml` on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system. Parameterized Remote Trigger Plugin 3.1.4 stores the secret encrypted once its configuration is saved again.

Related

Alias · CVE (1)

  • CVE-2020-2239 Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-311 Missing Encryption of Sensitive Data weakness

References