CVE-2020-2119
published 2020-02-12CVE-2020-2119: Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially…
PriorityP425medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.92%
60.2th percentile
Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | applatix_plugin | — | — |
| jenkins | azure_ad | <= 1.1.2 | — |
| jenkins | bmc_release_package_and_deployment_plugin | — | — |
| jenkins | digitalocean_plugin | — | — |
| jenkins | dynamic_extended_choice_parameter_plugin | — | — |
| jenkins | eagle_tester_plugin | — | — |
| jenkins | ecx_copy_data_management_plugin | — | — |
| jenkins | fitnesse_plugin | — | — |
| jenkins | git_parameter_plugin | — | — |
| jenkins | google_kubernetes_engine_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | harvest_scm_plugin | — | — |
| jenkins | ids_in_pipeline_github_notify_step_plugin | — | — |
| jenkins | ids_to_allow_users_configuring_the_plugin | — | — |
| jenkins | nunit_plugin | — | — |
| jenkins | parasoft_environment_manager_plugin | — | — |
| jenkins | pipeline_github_notify_step_plugin | — | — |
| jenkins | radargun_plugin | — | — |
| jenkins | s3_publisher_plugin | — | — |
| jenkins | sandbox_protection_in_script_security_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | subversion_plugin | — | — |
| jenkins | yaml_input_files_to_google_kubernetes_engine_plugin | — | — |
| jenkins_project | jenkins_azure_ad_plugin | unspecified – 1.1.2 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Jenkins
Jenkins Security Advisory 2020-02-12
vendor_jenkins·2020-02-12·CVSS 8.8
CVE-2020-2109 [HIGH] Jenkins Security Advisory 2020-02-12
Title: Jenkins Security Advisory 2020-02-12
Jenkins Security Advisory 2020-02-12
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Applatix
Plugin
BMC Release Package and Deployment
Plugin
brakeman
Plugin
debian-package-builder
Plugin
DigitalOcean
Plugin
Dynamic Extended Choice Parameter
Plugin
Eag
GHSA
Client secret transmitted in plain text by Azure AD Plugin
ghsa·2022-05-24
CVE-2020-2119 [LOW] CWE-256 Client secret transmitted in plain text by Azure AD Plugin
Client secret transmitted in plain text by Azure AD Plugin
Azure AD Plugin stores a client secret in its global configuration.
While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Azure AD Plugin 1.2.0 transmits the client secret in its global configuration encrypted.
OSV
Client secret transmitted in plain text by Azure AD Plugin
osv·2022-05-24
CVE-2020-2119 [LOW] Client secret transmitted in plain text by Azure AD Plugin
Client secret transmitted in plain text by Azure AD Plugin
Azure AD Plugin stores a client secret in its global configuration.
While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Azure AD Plugin 1.2.0 transmits the client secret in its global configuration encrypted.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-02-12
Published